Description (CNA)
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| microsoft / kiota-java | affected < 1.9.1 |
| microsoft / Microsoft.Kiota.Abstractions | affected < 1.22.0 |
| microsoft / github.com/microsoft/kiota-http-go | affected < 1.5.5 |
| microsoft / kiota-typescript | affected < 1.0.0-preview.100 |
| microsoft / microsoft-kiota-abstractions | affected < 1.9.1 |
| microsoft / microsoft-kiota-http | affected < 1.9.9 |
CWE
CWE-601
References
ADP enrichment
No English description supplied.