Detections
Analytics
SCA: security update for undici (GHSA-wqq4-5wpv-mx2g)
low Tenable Cloud Security Plugin ID 420076
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already
cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,
`cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in
browser environments. Since undici handles headers more liberally than the spec, there was a disconnect
from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to
accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection
target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version
5.26.2. There are no known workarounds. (CVE-2023-45143)
See Also
Plugin Details
Severity: Low
ID: 420076
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2023-45143
CVSS v3
Risk Factor: Low
Base Score: 3.5
Temporal Score: 3.1
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/16/2023
Vulnerability Publication Date: 10/12/2023
Reference Information
CVE: CVE-2023-45143
cwe: CWE-200