Skip to content

phin may include sensitive headers in subsequent requests after redirect

Moderate severity GitHub Reviewed Published Apr 11, 2024 in ethanent/phin • Updated Apr 11, 2024

Package

npm phin (npm)

Affected versions

< 3.7.1

Patched versions

3.7.1

Description

Impact

Users may be impacted if sending requests including sensitive data in specific headers with followRedirects enabled.

Patches

The follow-redirects library is now being used for redirects and removes some headers that may contain sensitive information in some situations.

Workarounds

N/A. Please update to resolve the issue.

References

@ethanent ethanent published to ethanent/phin Apr 11, 2024
Published to the GitHub Advisory Database Apr 11, 2024
Reviewed Apr 11, 2024
Last updated Apr 11, 2024

Severity

Moderate
4.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-x565-32qp-m3vf

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.