| Package | Affected versions | Patched versions |
|---|---|---|
| cross-fetch | < 3.1.5 | 3.1.5 |
| cross-fetch | ≥ 3.0.0, < 3.1.5< 2.2.6 | 3.1.52.2.6 |
This advisory has been withdrawn because the vulnerability originates from a dependency. For more information, see the Maintainer comments in https://huntr.com/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac.
When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty. Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free