GHSA-6h5x-7c5m-7cr7CriticalCVSS 9.3

Exposure of Sensitive Information in eventsource

Published
May 13, 2022
Last Modified
November 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-1650 →

📋 Description

When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."

🎯 Affected products2

  • npm/eventsource:< 1.1.1
  • npm/eventsource:>= 2.0.0, < 2.0.2

🔗 References (7)