Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2024-24758

Medium
4.5/10

Summary

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This vulnerability affects undici package versions prior to 5.28.3, and 6.x prior to 6.6.1 . Users are advised to upgrade. There are no known workarounds for this vulnerability. This vulnerability also affects nodejs package versions through 18.19.0, 19.0.0 through 20.11.0, and 21.0.0 through 21.6.1.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • HIGH
  • HIGH
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published