Vulnerability Description
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Follow-Redirects Project | Follow-Redirects | < 1.15.6 |
Related Weaknesses (CWE)
References
- https://fetch.spec.whatwg.org/#authentication-entriesTechnical Description
- https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95abPatch
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxExploitVendor Advisory
- https://github.com/psf/requests/issues/1885Issue Tracking
- https://hackerone.com/reports/2390009Issue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://fetch.spec.whatwg.org/#authentication-entriesTechnical Description
- https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95abPatch
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxExploitVendor Advisory
- https://github.com/psf/requests/issues/1885Issue Tracking
- https://hackerone.com/reports/2390009Issue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
FAQ
What is CVE-2024-28849?
CVE-2024-28849 is a vulnerability with a CVSS score of 6.5 (MEDIUM). follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization head...
How severe is CVE-2024-28849?
CVE-2024-28849 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-28849?
Check the references section above for vendor advisories and patch information. Affected products include: Follow-Redirects Project Follow-Redirects.