GHSA-7gc6-qh9x-w6h8

Source

https://github.com/advisories/GHSA-7gc6-qh9x-w6h8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-7gc6-qh9x-w6h8/GHSA-7gc6-qh9x-w6h8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7gc6-qh9x-w6h8

Aliases

CVE-2022-1365

Withdrawn

2025-10-08T19:22:14Z

Published

2022-04-17T00:00:32Z

Modified

2026-09-10T03:49:18Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Withdrawn Advisory: Incorrect Authorization in cross-fetch

Details

Withdrawn Advisory

This advisory has been withdrawn because the vulnerability originates from a dependency. For more information, see the Maintainer comments in https://huntr.com/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac.

Original Description

When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty. Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .

Database specific

{
    "cwe_ids":  [
        "CWE-359",
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-04-28T20:45:25Z",
    "nvd_published_at":  "2022-04-15T23:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / cross-fetch

Package

Name: cross-fetch; View open source insights on deps.dev
Purl: pkg:npm/cross-fetch

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.1.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-7gc6-qh9x-w6h8/GHSA-7gc6-qh9x-w6h8.json"

npm / cross-fetch

Package

Name: cross-fetch; View open source insights on deps.dev
Purl: pkg:npm/cross-fetch

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-7gc6-qh9x-w6h8/GHSA-7gc6-qh9x-w6h8.json"