GHSA-7gc6-qh9x-w6h8
Withdrawn Advisory: Incorrect Authorization in cross-fetch
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | cross-fetch | >= 3.0.0, < 3.1.5 | 3.1.5 |
| npm | cross-fetch | < 2.2.6 | 2.2.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Withdrawn Advisory
This advisory has been withdrawn because the vulnerability originates from a dependency. For more information, see the `Maintainer` comments in https://huntr.com/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac.
## Original Description
When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty.
Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .
References
External links from the advisory. They lead to third-party sites.