Homepage
About Snyk

Insufficiently Protected Credentials Affecting typed-rest-client package, versions <1.8.0

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    EPSS 0.24% (62nd percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-TYPEDRESTCLIENT-5487993
  • published 27 Apr 2023
  • disclosed 27 Apr 2023
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 27 Apr 2023

CVE-2023-30846 Open this link in a new tab
CWE-522 Open this link in a new tab

How to fix?

Upgrade typed-rest-client to version 1.8.0 or higher.

Overview

typed-rest-client is a Node Rest and Http Clients for use with TypeScript

Affected versions of this package are vulnerable to Insufficiently Protected Credentials when sending any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler. The target host may return a redirection (3xx), with a link to a second host and the next request will use the credentials to authenticate with the second host, by setting the Authorization header. The expected behavior is that the next request will NOT set the Authorization header.