CVE-2022-32210

EPSS 0.4%CWE-295

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

14 jul 2022Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Produtos afetados

n/a · https://github.com/nodejs/undici

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33 https://hackerone.com/reports/1583680