~ / search / GHSA-6h5x-7c5m-7cr7

GHSA-6h5x-7c5m-7cr7

Exposure of Sensitive Information in eventsource

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-1650

Packages

EcosystemPackageAffectedFixed in
npm eventsource < 1.1.1 1.1.1
npm eventsource >= 2.0.0, < 2.0.2 2.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."

References

External links from the advisory. They lead to third-party sites.