Insufficiently Protected Credentials Affecting typed-rest-client package, versions <1.8.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-TYPEDRESTCLIENT-5487993
- published 27 Apr 2023
- disclosed 27 Apr 2023
- credit Unknown
Introduced: 27 Apr 2023
CVE-2023-30846 Open this link in a new tabHow to fix?
Upgrade typed-rest-client to version 1.8.0 or higher.
Overview
typed-rest-client is a Node Rest and Http Clients for use with TypeScript
Affected versions of this package are vulnerable to Insufficiently Protected Credentials when sending any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler. The target host may return a redirection (3xx), with a link to a second host and the next request will use the credentials to authenticate with the second host, by setting the Authorization header. The expected behavior is that the next request will NOT set the Authorization header.