{"metadata": {"vulnerability": "ghsa-3787-6prv-h9w3", "count": 12, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2024-01-29T20:51:26.010Z", "date_only": false, "value": "2024-01-29T20:51:26.010Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2024-24758", "record": "CVE-2024-24758", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-02-16T16:02:52Z", "date_only": false, "value": "2024-02-16T16:02:52Z", "kind": "milestone", "label": "Published", "source": "github", "record": "ghsa-3787-6prv-h9w3", "field": "published"}, {"timestamp": "2024-02-16T17:12:46Z", "date_only": false, "value": "2024-02-16T17:12:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/186520", "record": "GHSA-3787-6PRV-H9W3", "field": "creation_timestamp", "uuid": "50f01e2a-719d-4d34-95ba-fb94670c16c2", "content": "https://ift.tt/nFXlASr\n[GHSA-3787-6prv-h9w3] Undici proxy-authorization header not cleared on cross-origin redirect in fetch", "url": "https://t.me/ctinow/186520"}, {"timestamp": "2024-02-16T21:40:37.716Z", "date_only": false, "value": "2024-02-16T21:40:37.716Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2024-24758", "record": "CVE-2024-24758", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-02-16T22:15:08Z", "date_only": false, "value": "2024-02-16T22:15:08Z", "kind": "other", "label": "Nvd published at", "source": "github", "record": "ghsa-3787-6prv-h9w3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-02-22T16:56:27.356Z", "date_only": false, "value": "2024-02-22T16:56:27.356620Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 \u00b7 CVE-2024-24758 / CISA-ADP", "record": "CVE-2024-24758", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-05-01T18:12:33.401Z", "date_only": false, "value": "2024-05-01T18:12:33.401Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-24758 / GitHub_M", "record": "CVE-2024-24758", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-05-02T13:15:07Z", "date_only": false, "value": "2024-05-02T13:15:07Z", "kind": "other", "label": "Updated", "source": "github", "record": "ghsa-3787-6prv-h9w3", "field": "modified"}, {"timestamp": "2024-06-04T17:43:23.837Z", "date_only": false, "value": "2024-06-04T17:43:23.837Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-24758 / CISA-ADP", "record": "CVE-2024-24758", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-01T23:28:11.855Z", "date_only": false, "value": "2024-08-01T23:28:11.855Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-24758 / CVE", "record": "CVE-2024-24758", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-13T17:40:21.660Z", "date_only": false, "value": "2025-02-13T17:40:21.660Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2024-24758", "record": "CVE-2024-24758", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-02-13T19:18:22Z", "date_only": false, "value": "2025-02-13T19:18:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4319", "record": "GHSA-3787-6PRV-H9W3", "field": "creation_timestamp", "uuid": "42f5556c-916c-4956-81fc-6f6444e0e320", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-30260\n\ud83d\udd25 CVSS Score: 3.9 (CVSS_V3)\n\ud83d\udd39 Description: ### Impact\n\nUndici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`.\n\n### Patches\n\nThis has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75.\nFixes has been released in v5.28.4 and v6.11.1.\n\n### Workarounds\n\nuse `fetch()` or disable `maxRedirections`.\n\n### References\n\nLinzi Shang reported this.\n\n* https://hackerone.com/reports/2408074\n* https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3\n\ud83d\udccf Published: 2024-04-04T14:20:39Z\n\ud83d\udccf Modified: 2025-02-13T19:02:14Z\n\ud83d\udd17 References:\n1. https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7\n2. https://nvd.nist.gov/vuln/detail/CVE-2024-30260\n3. https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f\n4. https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75\n5. https://hackerone.com/reports/2408074\n6. https://github.com/nodejs/undici\n7. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33\n8. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ\n9. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E", "url": "https://t.me/DarkWebInformer_CVEAlerts/4319"}]}