PT-2022-13333 · Fgribreau · Node-Request-Retry

Sampaguitas · Published 2022-02-22 · Updated 2022-03-02 · CVE-2022-0654

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions fgribreau/node-request-retry versions prior to 7.0.0

Description The issue concerns the exposure of sensitive information to unauthorized actors. This occurs in the fgribreau/node-request-retry GitHub repository, where cookies are leaked to external sites, potentially compromising user data.

Recommendations For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-0654

GHSA-HJP8-2CM3-CC45

Affected Products

Node-Request-Retry

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0654.json · Exploit
• 🔥 https://huntr.dev/bounties/a779faf5-c2cc-48be-a31d-4ddfac357afc · Exploit
• https://github.com/fgribreau/node-request-retry/commit/0979c6001d9d57c2aac3157c11b007397158922a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0654 · Security Note
• https://osv.dev/vulnerability/GHSA-hjp8-2cm3-cc45 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0654 · Vendor Advisory
• https://t.me/cibsecurity/37913 · Telegram Post