{"id":"CVE-2024-24758","published":"2024-02-16T21:40:37Z","modified":"2025-02-13T17:40:21Z","title":"Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici","vendor":"nodejs","product":"undici","tier":"tail","description":{"text":"Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.9,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00765,"percentile":0.55469,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20240419-0007/","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/11/1","tags":[]}],"priority":{"score":13.8,"factors":[{"name":"EPSS percentile","points":11.09},{"name":"CVSS severity","points":2.73}]},"vendorSlug":"nodejs","affectedVersions":[{"vendor":"nodejs","product":"undici","versions":["< 5.28.3",">= 6.0.0, < 6.6.1"]}],"affected":[{"ecosystem":"npm","package":"undici","vulnerableRanges":["<5.28.3",">=6.0.0, <6.6.1"],"patched":["5.28.3","6.6.1"],"from":["GHSA-3787-6prv-h9w3"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0479","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-hapijs-wreck-cve-2024-24758","children":[{"from":"CVE-2024-24758","to":"CVE-2026-44979","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-vhjm-w67q-g75c","via":"reference","url":"https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3"}]}],"packageHistory":[{"cve":"CVE-2023-24807","published":"2023-02-16","fixed":"5.19.1","kev":false},{"cve":"CVE-2023-45143","published":"2023-10-12","fixed":"5.26.2","kev":false,"link":{"from":"CVE-2023-45143","to":"CVE-2024-24758","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:undici","fromFixed":"5.26.2","toFixed":"5.28.3","daysApart":127}]}},{"cve":"CVE-2024-24750","published":"2024-02-16","fixed":"6.6.1","kev":false},{"cve":"CVE-2024-24758","published":"2024-02-16","fixed":"6.6.1","kev":false},{"cve":"CVE-2024-30260","published":"2024-04-04","fixed":"6.11.1","kev":false,"link":{"from":"CVE-2024-24758","to":"CVE-2024-30260","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:undici","fromFixed":"5.28.3","toFixed":"5.28.4","daysApart":48},{"kind":"version-step","provenance":"source","package":"npm:undici","fromFixed":"6.6.1","toFixed":"6.11.1","daysApart":48}]}},{"cve":"CVE-2024-30261","published":"2024-04-04","fixed":"6.11.1","kev":false,"link":{"from":"CVE-2024-24758","to":"CVE-2024-30261","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:undici","fromFixed":"5.28.3","toFixed":"5.28.4","daysApart":48},{"kind":"version-step","provenance":"source","package":"npm:undici","fromFixed":"6.6.1","toFixed":"6.11.1","daysApart":48}]}},{"cve":"CVE-2024-38372","published":"2024-07-08","fixed":"6.19.2","kev":false}],"package":"npm:undici"}}