{
"id": "GHSA-7gc6-qh9x-w6h8",
"aliases": [
"CVE-2022-1365"
],
"details": "## Withdrawn Advisory\nThis advisory has been withdrawn because the vulnerability originates from a dependency. For more information, see the `Maintainer` comments in https://huntr.com/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac.\n\n## Original Description\nWhen fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty.\nEx: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .",
"summary": "Withdrawn Advisory: Incorrect Authorization in cross-fetch",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.5"
}
]
}
],
"package": {
"name": "cross-fetch",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.6"
}
]
}
],
"package": {
"name": "cross-fetch",
"ecosystem": "npm"
}
}
],
"modified": "2025-10-08T19:22:14Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"published": "2022-04-17T00:00:32Z",
"withdrawn": "2025-10-08T19:22:14Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1365",
"type": "ADVISORY"
},
{
"url": "https://github.com/lquixada/cross-fetch/pull/135",
"type": "WEB"
},
{
"url": "https://github.com/lquixada/cross-fetch/commit/a3b3a9481091ddd06b8f83784ba9c4e034dc912a",
"type": "WEB"
},
{
"url": "https://github.com/lquixada/cross-fetch",
"type": "PACKAGE"
},
{
"url": "https://huntr.dev/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-359",
"CWE-863"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2022-04-15T23:15:00Z",
"github_reviewed_at": "2022-04-28T20:45:25Z"
}
}