Incorrect authorization in cross-fetch - CVE-2022-1365

Vulnerability identifier: #VU66071

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1365

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to exposure of sensitive information due to insecure following of redirects. A remote attacker can force the application to redirect to a malicious website and gain access to authorization cookie.

cross-fetch
Migration Toolkit for Containers
Cloud Pak for Security (CP4S)
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
IBM Business Automation Manager Open Editions
Red Hat Advanced Cluster Management for Kubernetes

Install updates from vendor's website.

cross-fetch - update to 3.1.5
Migration Toolkit for Containers - update to 1.7.3
Cloud Pak for Security (CP4S) - update to 1.10.7.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.1
IBM Business Automation Manager Open Editions - update to 8.0.1
Red Hat Advanced Cluster Management for Kubernetes - update to 2.4.4

• https://github.com/lquixada/cross-fetch/commit/a3b3a9481091ddd06b8f83784ba9c4e034dc912a
• https://huntr.dev/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac

• Information disclosure in cross-fetch
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.4