Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
redhatcveRedhat.comRH:CVE-2024-24758
HistoryFeb 18, 2024 - 12:19 p.m.

CVE-2024-24758

2024-02-1812:19:29
redhat.com
access.redhat.com
12
undici
vulnerability
sensitive information exposure
cross-origin
proxy-authentication

CVSS3

3.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

AI Score

4.1

Confidence

High

EPSS

0

Percentile

15.5%

JSON

A sensitive information exposure vulnerability was found in undici. In this issue, it cleared Authorization headers on cross-origin redirects but did not clear the Proxy-Authentication headers.

Related

cve 1
github 1
cvelist 1
cbl_mariner 1
hackerone 2
osv 4
veracode 1
ubuntucve 1
debiancve 1
ibm 6
prion 1
nvd 1
vulnrichment 1
nessus 8
openvas 9
nodejsblog 1
cve
cve
CVE-2024-24758
2024-02-16 22:15:08
github
github
Undici proxy-authorization header not cleared on cross-origin redirect in fetch
2024-02-16 16:02:52
cvelist
cvelist
CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
2024-02-16 21:40:37
cbl_mariner
cbl_mariner
CVE-2024-24758 affecting package nodejs for versions less than 20.14.0-1
2024-06-21 09:32:44
hackerone
hackerone
Node.js: Proxy-Authorization header is not cleared in cross-domain redirect in undici
2024-02-02 16:09:11
Internet Bug Bounty: Proxy-Authorization header is not cleared in cross-domain redirect in undici
2024-02-26 05:59:27
osv
osv
Undici proxy-authorization header not cleared on cross-origin redirect in fetch
2024-02-16 16:02:52
CVE-2024-24758
2024-02-16 22:15:08
corepack21-21.6.2-1.1 on GA media
2024-06-15 00:00:00
veracode
veracode
Proxy-Authentication Header Leakage
2024-02-19 05:12:23
ubuntucve
ubuntucve
CVE-2024-24758
2024-02-16 00:00:00
debiancve
debiancve
CVE-2024-24758
2024-02-16 22:15:08
ibm
ibm
Security Bulletin: IBM Cloud Pak for Data is vulnerable to exposing sensitive information due to Undici ( CVE-2024-24758 )
2024-08-08 15:47:55
Security Bulletin: IBM App Connect Enterprise Certified Container flows using Box are vulnerable to loss of confidentiality due to [CVE-2024-24758]
2024-03-05 16:01:04
Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js.
2024-05-10 14:52:40
prion
prion
Authorization
2024-02-16 22:15:00
nvd
nvd
CVE-2024-24758
2024-02-16 22:15:08
vulnrichment
vulnrichment
CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
2024-02-16 21:40:37
nessus
nessus
Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-568)
2024-03-21 00:00:00
SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2024:0729-1)
2024-03-06 00:00:00
SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2024:0728-1)
2024-03-06 00:00:00
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2024:0728-1)
2024-03-04 00:00:00
SUSE: Security Advisory (SUSE-SU-2024:0729-1)
2024-03-04 00:00:00
openSUSE: Security Advisory for nodejs16 (SUSE-SU-2024:0728-1)
2024-03-08 00:00:00
nodejsblog
nodejsblog
Wednesday February 14 2024 Security Releases
2024-02-14 00:00:00

CVSS3

3.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

AI Score

4.1

Confidence

High

EPSS

0

Percentile

15.5%

JSON
Related for RH:CVE-2024-24758
cve1github1cvelist1cbl_mariner1hackerone2osv4veracode1ubuntucve1debiancve1ibm6prion1nvd1vulnrichment1nessus8openvas9nodejsblog1