GHSA-wpg7-2c88-r8xvHighCVSS 7.5

Exposure of Sensitive Information in simple-get

Published
January 28, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-0355 →

📋 Description

In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party.

🎯 Affected products3

  • npm/simple-get:= 4.0.0
  • npm/simple-get:>= 3.0.0, < 3.1.1
  • npm/simple-get:< 2.8.2

🔗 References (6)