CVE-2023-30846

    Dashboard / Vulnerabilities / CVE-2023-30846

    CVE-2023-30846

    Published: 26 Apr 2023Last Modified: 12 Aug 2026

    Summary: typed-rest-client vulnerable to potential leak of authentication data to 3rd parties

    Details: typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the `Authorization` header. The expected behavior is that the next request will *NOT* set the `Authorization` header. The problem was fixed in version 1.8.0. There are no known workarounds.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30846.json, https://github.com/microsoft/typed-rest-client/security/advisories/GHSA-558p-m34m-vpmq, https://nvd.nist.gov/vuln/detail/CVE-2023-30846, https://security.netapp.com/advisory/ntap-20230601-0008/, https://github.com/microsoft/typed-rest-client/commit/f9ff755631b982ee1303dfc3e3c823d0d31233e8

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5fcb9c0945378d3a7463837c9716fb1f8257efe1

    Affected versions

    1.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-30846 | CVE-DB