CVE-2024-30260 (Low) detected in multiple libraries

[mend-bolt-for-github]

CVE-2024-30260 - Low Severity Vulnerability

Vulnerable Libraries - undici-5.27.2.tgz, undici-5.22.1.tgz, undici-5.11.0.tgz

undici-5.27.2.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.27.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• plugin-api-5.1.2.tgz (Root Library)
  • ❌ undici-5.27.2.tgz (Vulnerable Library)

undici-5.22.1.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.22.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• discord.js-14.13.0.tgz (Root Library)
  • ❌ undici-5.22.1.tgz (Vulnerable Library)

undici-5.11.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-5.11.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• prisma-import-1.0.4.tgz (Root Library)
  • internals-4.7.1.tgz
    • engine-core-4.7.1.tgz
      • ❌ undici-5.11.0.tgz (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request(). This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Publish Date: 2024-04-04

URL: CVE-2024-30260

CVSS 3 Score Details (3.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m4v8-wqvr-p9f7

Release Date: 2024-04-04

Fix Resolution: undici - 5.28.4,6.11.1

---

Step up your Open Source Security Game with Mend here