CVE-2024-28849

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-28858.8Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2024-288508.1WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create event CVE-2024-288517.8The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has CVE-2024-288526.1Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means th CVE-2024-288535.9Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting (XSS) vulnerability in ampache before CVE-2024-288547.5tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious CVE-2024-288556.1ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/templa CVE-2024-288599.0Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP CVE-2024-28867.5Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted CVE-2024-288606.8Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium m CVE-2024-288619.8Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to CVE-2024-288625.5The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had