Vulnerabilities

 1 via 1 paths

Dependencies

 316

Source

 GitHub

Commit

 78d64037

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity

Exposure of Sensitive Information to an Unauthorized Actor

  • Vulnerable module: phin
  • Introduced through: jimp@0.16.13

Detailed paths

  • Introduced through: qr-scanner-cli@victorperin/qr-scanner-cli#78d640374c406e63459ebedc621126ce59eb5e5e › jimp@0.16.13 › @jimp/custom@0.16.13 › @jimp/core@0.16.13 › phin@2.9.3
    Remediation: Upgrade to jimp@0.22.0.

Overview

phin is a The ultra-lightweight Node.js HTTP client

Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor due to the handling of HTTP headers during redirects when followRedirects is enabled. An attacker can potentially intercept sensitive information by exploiting how headers are included in outgoing requests after a redirect.

Remediation

Upgrade phin to version 3.7.1 or higher.

References

Exposure of Sensitive Information to an Unauthorized Actor vulnerability report