CVE-2020-11021

Katalog CVE

CVSS 7.5 · High EPSS 1,8%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada http-client project http-client. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

Rincian

Terbit di NVD

29 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/actions/http-client/commit/f6aae3dda4f4c9dc0b49737b36007330f78fd53a patch · advisory pihak ketiga
• https://github.com/actions/http-client/pull/27 patch · advisory pihak ketiga
• https://github.com/actions/http-client/security/advisories/GHSA-9w6v-m7wp-jwg4 advisory pihak ketiga