BlackTreeIndependent security intelligence

Full vulnerability report · 2022

CVE-2022-0235High confidence

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

node-fetch · node-fetch/node-fetch

6.1MediumCVSS 3.1

Recommended action

Within 7 days

Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.

Patch available

Direct vendor intelligence

Authoritative vendor CSAF and VEX advisories

Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.

2 current

CVE-2022-0235 · CSAF 2.0 · revision 3 · finalRed Hat Product Securitynode-fetch: exposure of sensitive information to an unauthorized actor

140 known affected

The vendor explicitly identifies these products as affected by this CVE.

rh-dotnet31-aspnetcore-runtime-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-aspnetcore-targeting-pack-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet-apphost-pack-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet-host as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet-hostfxr-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet-runtime-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet-sdk-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet-sdk-3.1-source-built-artifacts as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet-targeting-pack-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet-templates-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux
rh-dotnet31-dotnet.src as a component of .NET Core 3.1 on Red Hat Enterprise Linux

Summary: A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as "Authorization," "WWW-Authenticate," and "Cookie" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized actor.
Remediation: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

SSA-637483 · CSAF 2.0 · revision 1 · finalSiemens ProductCERTSSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2

1 known affected

The vendor explicitly identifies these products as affected by this CVE.

SINEC INS

Summary: node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Remediation: Update to V1.0 SP2 or later version

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current

ENISA EUVD identifier

EUVD-2022-0683

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state: Present in the current official mapping
Known exploitation: Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score: Not supplied in the stored EUVD record
Advisory evidence: No linked advisory details stored yet

Recommended actionWithin 7 days

Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.

Patch available

What, why and how

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

What

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Why

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How

An attacker operating through a network path may attempt exploitation without authentication after a user interaction. If successful, the issue may obtain information outside the intended access boundary.

What

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Why

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

Reference recorded

A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.

Likely attack path: a network path → Exposure of Sensitive Information to an Unauthorized Actor → obtain information outside the intended access boundary
Attack surface: Network
Privileges required: None: unauthenticated exploitation is possible
User interaction: Required interaction required
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Changed: exploitation can affect a different security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-200 ↗
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UIRequiredUser interaction: Another user must perform an action for exploitation to succeed.SChangedScope: The attack can affect a component governed by a different security authority.CLowConfidentiality impact: A successful attack can cause a limited loss.ILowIntegrity impact: A successful attack can cause a limited loss.ANoneAvailability impact: No direct loss is represented by this metric.
Post-exploitation / living off the land: No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.

NetworkUnauthenticatedCWE-200Public exploit reference

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2022-0683Official EUVD mapping

0 linked advisory records.

Official EUVD record

BSI · German · WID-SEC-W-2022-1603IBM Tivoli Netcool/OMNIbus: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Tivoli Netcool/OMNIbus ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen.

Official advisory

BSI · German · WID-SEC-W-2022-2366HCL BigFix: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Informationen offenzulegen eine URL Redirection durchzuführen oder Code auszuführen.

Official advisory

BSI · German · WID-SEC-W-2023-0426IBM Spectrum Protect: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um einen 'Denial of Service'-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, einen 'Cross-Site-Scripting'-Angriff durchzuführen, beliebigen Code auszuführen, sensible Informationen offenzulegen und seine Privilegien zu erweitern.

Official advisory

BSI · German · WID-SEC-W-2022-0235Red Hat Advanced Cluster Management: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Advanced Cluster Management ausnutzen, um seine Privilegien zu erhöhen.

Official advisory

BSI · German · WID-SEC-W-2022-0417Red Hat OpenShift Service Mesh: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh ausnutzen, um Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

Official advisory

BSI · German · WID-SEC-W-2022-2133JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten

JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar.

Official advisory

CERT-FR · French · CERTFR-2024-AVI-0923Multiples vulnérabilités dans les produits IBM

ecord?id=CVE-2020-15168 Référence CVE CVE-2020-27216 https://www.cve.org/CVERecord?id=CVE-2020-27216 Référence CVE CVE-2021-28169 https://www.cve.org/CVERecord?id=CVE-2021-28169 Référence CVE CVE-2021-34428 https://www.cve.org/CVERecord?id=CVE-2021-34428 Référence CVE CVE-2021-3803 https://www.cve.org/CVERecord?id=CVE-2021-3803 Référence CVE CVE-2021-40690 https://www.cve.org/CVERecord?id=CVE-2021-40690 Référence CVE CVE-2021-43138 https://www.cve.org/CVERecord?id=CVE-2021-43138 Référence CVE CVE-2021-44906 https://www.cve.org/CVERecord?id=CVE-2021-44906 Référence CVE CVE-2022-0144 https://www.cve.org/CVERecord?id=CVE-2022-0144 Référence CVE CVE-2022-0235 https://www.cve.org/CVERecord?id=CVE-2022-0235 Référence CVE CVE-2022-24735 https://www.cve.org/CVERecord?id=CVE-2022-24735 Référence CVE CVE-2022-24736 https://www.cve.org/CVERecord?id=CVE-2022-24736 Référence CVE CVE-2022-24834 https://www.cve.org/CVERecord?id=CVE-2022-24834 Référence CVE CVE-2022-25883 https://www.cve.org/CVERecord?id=CVE-2022-25883 Référence CVE CVE-2022-29622 https://www.cve.org/CVERecord?id=CVE-2022-29622 Référence CVE CVE-2022-3517 https://www.cve.org/CVERecord?id=CVE-2022-3517 Référence CVE CVE-2022-36943 https://www.cve.org/CVERecord?id=CVE-2022-36943 Référence CVE CVE-2022-38900 https://www.cve.org/CVERecord?id=CVE

Official advisory

CERT-FR · French · CERTFR-2023-AVI-0286Multiples vulnérabilités dans les produits IBM

De multiples vulnérabilités ont été découvertes dans les produits IBM . Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.

Official advisory

CERT-FR · French · CERTFR-2022-AVI-814Multiples vulnérabilités dans les produits SIEMENS

VERecord?id=CVE-2020-7793 Référence CVE CVE-2021-23337 https://www.cve.org/CVERecord?id=CVE-2021-23337 Référence CVE CVE-2021-23839 https://www.cve.org/CVERecord?id=CVE-2021-23839 Référence CVE CVE-2021-23841 https://www.cve.org/CVERecord?id=CVE-2021-23841 Référence CVE CVE-2021-25217 https://www.cve.org/CVERecord?id=CVE-2021-25217 Référence CVE CVE-2021-25220 https://www.cve.org/CVERecord?id=CVE-2021-25220 Référence CVE CVE-2021-3749 https://www.cve.org/CVERecord?id=CVE-2021-3749 Référence CVE CVE-2021-4160 https://www.cve.org/CVERecord?id=CVE-2021-4160 Référence CVE CVE-2022-0155 https://www.cve.org/CVERecord?id=CVE-2022-0155 Référence CVE CVE-2022-0235 https://www.cve.org/CVERecord?id=CVE-2022-0235 Référence CVE CVE-2022-0396 https://www.cve.org/CVERecord?id=CVE-2022-0396 Référence CVE CVE-2022-37011 https://www.cve.org/CVERecord?id=CVE-2022-37011 Référence CVE CVE-2022-38466 https://www.cve.org/CVERecord?id=CVE-2022-38466 Référence CVE CVE-2022-39137 https://www.cve.org/CVERecord?id=CVE-2022-39137 Référence CVE CVE-2022-39138 https://www.cve.org/CVERecord?id=CVE-2022-39138 Référence CVE CVE-2022-39139 https://www.cve.org/CVERecord?id=CVE-2022-39139 Référence CVE CVE-2022-39140 https://www.cve.org/CVERecord?id=CVE-2022-39140 Référence CVE CVE-2022-39141 https://www.cve.org/CVERecord?id=CVE

Official advisory

CERT-FR · French · CERTFR-2022-AVI-239Multiples vulnérabilités dans les produits IBM

ord?id=CVE-2021-38951 Référence CVE CVE-2021-39002 https://www.cve.org/CVERecord?id=CVE-2021-39002 Référence CVE CVE-2021-4034 https://www.cve.org/CVERecord?id=CVE-2021-4034 Référence CVE CVE-2021-41182 https://www.cve.org/CVERecord?id=CVE-2021-41182 Référence CVE CVE-2021-41183 https://www.cve.org/CVERecord?id=CVE-2021-41183 Référence CVE CVE-2021-41184 https://www.cve.org/CVERecord?id=CVE-2021-41184 Référence CVE CVE-2021-41617 https://www.cve.org/CVERecord?id=CVE-2021-41617 Référence CVE CVE-2021-44716 https://www.cve.org/CVERecord?id=CVE-2021-44716 Référence CVE CVE-2021-44717 https://www.cve.org/CVERecord?id=CVE-2021-44717 Référence CVE CVE-2022-0235 https://www.cve.org/CVERecord?id=CVE-2022-0235 Référence CVE CVE-2022-0391 https://www.cve.org/CVERecord?id=CVE-2022-0391 Référence CVE CVE-2022-21680 https://www.cve.org/CVERecord?id=CVE-2022-21680 Référence CVE CVE-2022-21681 https://www.cve.org/CVERecord?id=CVE-2022-21681 Référence CVE CVE-2022-23772 https://www.cve.org/CVERecord?id=CVE-2022-23772 Référence CVE CVE-2022-23773 https://www.cve.org/CVERecord?id=CVE-2022-23773 Référence CVE CVE-2022-23806 https://www.cve.org/CVERecord?id=CVE-2022-23806 Gestion détaillée du document le 14 mars 2022 Version initiale Alertes Avis Bulletins d’actualités Mentions légales Conditions générales À pro

Official advisory

CERT-FR · French · CERTFR-2022-AVI-1025Multiples vulnérabilités dans IBM QRadar

De multiples vulnérabilités ont été découvertes dans IBM QRadar. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.

Official advisory

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Patch available
Affected: rh-dotnet31-aspnetcore-runtime-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-aspnetcore-targeting-pack-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet-apphost-pack-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet-host as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet-hostfxr-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet-runtime-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet-sdk-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet-sdk-3.1-source-built-artifacts as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet-targeting-pack-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet-templates-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-dotnet.src as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet31-netstandard-targeting-pack-2.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux; rh-dotnet50-aspnetcore-runtime-5.0 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-aspnetcore-targeting-pack-5.0 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet-apphost-pack-5.0 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet-host as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet-hostfxr-5.0 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet-runtime-5.0 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet-sdk-5.0 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet-sdk-5.0-source-built-artifacts as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet-targeting-pack-5.0 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet-templates-5.0 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-dotnet.src as a component of .NET Core 5.0 on Red Hat Enterprise Linux; rh-dotnet50-netstandard-targeting-pack-2.1 as a component of .NET Core 5.0 on Red Hat Enterprise Linux; distributed-tracing/jaeger-query-rhel8 as a component of Distributed Tracing Jaeger 1; migration-toolkit-virtualization/mtv-ui-rhel8 as a component of Migration Toolkit for Virtualization; odo.src as a component of OpenShift Developer Tools and Services; servicemesh-grafana as a component of OpenShift Service Mesh 2.0; and 110 more
Fixed: rh-nodejs14-nodejs-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-0:14.21.1-3.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7); rh-nodejs14-nodejs-0:14.21.1-3.el7.src as a component of Red Hat Software Collections for RHEL(v. 7); rh-nodejs14-nodejs-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7); rh-nodejs14-nodejs-debuginfo-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7); rh-nodejs14-nodejs-devel-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7); rh-nodejs14-nodejs-docs-0:14.21.1-3.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7); rh-nodejs14-nodejs-full-i18n-0:14.21.1-3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7); rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7); rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7.src as a component of Red Hat Software Collections for RHEL(v. 7); rh-nodejs14-npm-0:6.14.17-14.21.1.3.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7); openshift-service-mesh/kiali-rhel8@sha256:00bf086034f38940086c4f92343b5e239d590cb35b2019d71e4cdb4f0f28b61e_amd64 as a component of OpenShift Service Mesh 2.1; openshift-service-mesh/kiali-rhel8@sha256:b4adcc404793aa643428a07885581241286ed0593ca88c2ae0593efc20a9244e_s390x as a component of OpenShift Service Mesh 2.1; and 72 more
Action: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
Workaround: No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.

Evidence and provenance

Published 16 Jan 2022 · Last source change 2 Aug 2024, 23:18 UTC · CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor

CVE recordCVE.org · 5.1

CVSS sourceNIST NVD

EPSS source

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-08-14

European sourceENISA EUVD · EUVD-2022-0683

Product sourceVendor CSAF · Red Hat Product Security

Remediation sourceVendor CSAF · Red Hat Product Security

CWE sourceCNA

NVD statusNVD modified after enrichment

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates →

No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.

2022-01-16CVE published

2024-08-02Fixed release or patch reference recorded

ENISA EUVD · EUVD-2022-0683↗Vendor CSAF · Red Hat Product Security↗Patch or update reference↗Patch or update reference↗Public exploit reference↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

National CERT insights ?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

EUVD-2022-0683

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.