CVE-2022-31151
Description
A flaw was found in the undici package. After cookie headers are set, they are not cleared. This issue could allow an attacker to take advantage of this cookie, which could be used to control the redirection target.
Mitigation
By default, this vulnerability is not exploitable. In order to make sure this is mitigated, do not enable redirections, i.e.: `maxRedirections: 0`
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | 6.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | Low | N/A |
| Integrity Impact | Low | Low | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat CVSS v3 Score Explanation
We consider this vulnerability is complex to exploit for several reasons as it is in the public information we rely on the upstream reference https://github.com/nodejs/undici/issues/872. First it should enabled the redirection (which is not enabled by default). It should exists a redirecting to third party origin during a specific time frame, and also it should control the redirection target. For these reasons we do not consider the attack can be easily performed. Also we consider confidentiality is not impacted by this flaw as a cookie is not reveling any information as such, even this can be used from the attacker.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
