ethanent/phin · Security
phin may include sensitive headers in subsequent requests after redirect
- GHSA ID
- GHSA-x565-32qp-m3vf
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS v3
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Description
Impact
Users may be impacted if sending requests including sensitive data in specific headers with followRedirects enabled.
Patches
The follow-redirects library is now being used for redirects and removes some headers that may contain sensitive information in some situations.
Workarounds
N/A. Please update to resolve the issue.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor