Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-24758

Good to know:

icon
icon

Date: February 16, 2024

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear "Proxy-Authentication" headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Language: JS

Severity Score

Related Resources (12)

https://github.com/nodejs/undici/commit/d3aa574b1259c1d8d329a0f0f495ee82882b1458
https://nvd.nist.gov/vuln/detail/CVE-2024-24758
https://github.com/nodejs/undici/releases/tag/v5.28.3
https://github.com/nodejs/undici
https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef
https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
http://www.openwall.com/lists/oss-security/2024/03/11/1
https://security.netapp.com/advisory/ntap-20240419-0007
https://security-tracker.debian.org/tracker/CVE-2024-24758
https://github.com/nodejs/undici/releases/tag/v6.6.1
https://security.netapp.com/advisory/ntap-20240419-0007/
https://www.mend.io/vulnerability-database/CVE-2024-24758

Severity Score

Weakness Type (CWE)

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

Top Fix

icon

Upgrade Version

Upgrade to version undici - 6.6.1;undici - 5.28.3

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): HIGH
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us