CVE-2022-0235

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

Published Jan 16, 2022 CVSS 3.1 · 6.1 Medium EPSS 1.8% KEV · Not listed
Description
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-3222-1 node-fetch security update
EUVD EUVD EUVD-2022-0683 node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Github GHSA Github GHSA GHSA-r683-j2x4-v87g node-fetch forwards secure headers to untrusted sites
Ubuntu USN Ubuntu USN USN-6158-1 Node Fetch vulnerability
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Metrics epss

{'score': 0.00528}

epss

{'score': 0.00556}

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8