Skip to content
Fencer Intel
high 8.0

CVE-2022-0155 json

Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects

published 4y ago modified last mo. also GHSA-74fj-2j2h-c42q , EUVD-2022-0494

cvss
8.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Patch / fix

  • npm follow-redirects 1.14.7
  • follow-redirects follow-redirects/follow-redirects 1.14.7
  • node-follow-redirects Debian 14, Debian 13, Debian 12 1.14.7+~1.13.1-1

debian advisories DEBIAN-CVE-2022-0155

  • node-follow-redirects Ubuntu Pro 18.04 LTS 1.2.4-1ubuntu0.18.04.1~esm1
  • node-follow-redirects Ubuntu Pro 20.04 LTS 1.2.4-1ubuntu0.20.04.1~esm1

ubuntu advisories UBUNTU-CVE-2022-0155

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rhvm rhev manager 4.4 4.5.3.2-1.el8ev
  • ovirt-engine rhev manager 4.4 4.5.3.2-1.el8ev
  • ovirt-web-ui rhev manager 4.4 1.9.2-1.el8ev
  • ovirt-engine-dwh rhev manager 4.4 4.5.7-1.el8ev
  • ovirt-engine-setup rhev manager 4.4 4.5.3.2-1.el8ev
  • ovirt-engine-tools rhev manager 4.4 4.5.3.2-1.el8ev
  • ovirt-engine-backend rhev manager 4.4 4.5.3.2-1.el8ev
  • ovirt-engine-restapi rhev manager 4.4 4.5.3.2-1.el8ev

red hat advisories RHSA-2022:8502

  • grafana SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5 9.5.8-150200.3.53.2
  • grafana Manager Client Tools 15 9.5.8-150000.1.60.2
  • spacecmd openSUSE Leap 15.5, Manager Client Tools 15 4.3.26-150000.3.113.1
  • mgr-daemon Manager Client Tools 15 4.3.8-150000.1.44.1
  • spacewalk-client-tools Manager Client Tools 15 4.3.18-150000.3.86.2
  • prometheus-postgres_exporter openSUSE Leap 15.5, Manager Client Tools 15 0.10.1-150000.1.17.1
  • uyuni-proxy-systemd-services Manager Client Tools for SLE Micro 5, Manager Client Tools 15 4.3.10-150000.1.15.1
  • golang-github-prometheus-prometheus Manager Client Tools 15 2.45.0-150000.3.53.1

suse advisories SUSE-RU-2024:0511-1SUSE-SU-2024:0487-1SUSE-SU-2024:0486-1SUSE-SU-2024:0196-1SUSE-SU-2024:0191-1SUSE-SU-2023:2579-1

  • grafana openSUSE Tumbleweed 9.3.6-1.1

opensuse advisories openSUSE-SU-2024:12723-1

Is CVE-2022-0155 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0155 updated cvss 6.5

follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor

  • Red Hat OpenShift Service Mesh 1 npm-follow-redirects
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Service Mesh 2.0 npm-follow-redirects
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, openshift4/ose-console, rhacm2/search-ui-rhel8, rhacm2/mcm-topology-rhel8, rhacm2/application-ui-rhel8, rhacm2/console-header-rhel8, +1 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 3 follow-redirects
    affected: no fix available
  • Red Hat Openshift Data Foundation 4.14 odf4 v4.14-1764178221, odf4 v4.14-1764178222, odf4 v4.14-1764178236, odf4 v4.14-1764178261, odf4 v4.14-1764178273, odf4 v4.14-1764178319, +11 more
    fixed: vendor fix RHSA-2025:22420
  • Red Hat Openshift Data Foundation 4.15 odf4 v4.15-1764176261, odf4 v4.15-1764176342, odf4 v4.15-1764176372, odf4 v4.15-1764176485, odf4 v4.15-1764176675, odf4 v4.15-1764176690, +11 more
    fixed: vendor fix RHSA-2025:22418
  • Red Hat Openshift Data Foundation 4.16 odf4 v4.16-1764168955, odf4 v4.16-1764169118, odf4 v4.16-1764169242, odf4 v4.16-1764169347, odf4 v4.16-1764169457, odf4 v4.16-1764169464, +12 more
    fixed: vendor fix RHSA-2025:22416
  • Red Hat Openshift Data Foundation 4.17 odf4 v4.17-1764167795, odf4 v4.17-1764167826, odf4 v4.17-1764167834, odf4 v4.17-1764167876, odf4 v4.17-1764167987, odf4 v4.17-1764168179, +12 more
    fixed: vendor fix RHSA-2025:22415
show 5 more
  • Red Hat Openshift Data Foundation 4.18 odf4 v4.18-1761854280, odf4 v4.18-1761854289, odf4 v4.18-1761854319, odf4 v4.18-1761854321, odf4 v4.18-1761854398, odf4 v4.18-1761854422, +12 more
    fixed: vendor fix RHSA-2025:21368
  • Red Hat Openshift Data Foundation 4.19 odf4 v4.19-1761832915, odf4 v4.19-1761832946, odf4 v4.19-1761832992, odf4 v4.19-1761833034, odf4 v4.19-1761833068, odf4 v4.19-1761833085, +13 more
    fixed: vendor fix RHSA-2025:21378
  • Red Hat Openshift Data Foundation 4.20 odf4 v4.20-1761728558, odf4 v4.20-1761728716, odf4 v4.20-1761728784, odf4 v4.20-1761728797, odf4 v4.20-1761728814, odf4 v4.20-1761728854, +16 more
    fixed: vendor fix RHSA-2025:21704
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-web-ui 1.9.2-1.el8ev
    fixed: vendor fix RHSA-2022:8502
  • Red Hat Openshift Data Foundation 4.14 odf4 v4.14-1764225636, odf4 v4.14-1764225638, odf4 v4.14-1764225641, odf4 v4.14-1764225644, odf4 v4.14-1764225646, odf4 v4.14-1764225650, +2 more Red Hat Openshift Data Foundation 4.15 odf4 v4.15-1764223440, odf4 v4.15-1764223444, odf4 v4.15-1764223449, odf4 v4.15-1764223450, odf4 v4.15-1764223456, odf4 v4.15-1764223457, +1 more Red Hat Openshift Data Foundation 4.16 odf4 v4.16-1764224668, odf4 v4.16-1764224669, odf4 v4.16-1764224673, odf4 v4.16-1764224676, odf4 v4.16-1764224682, odf4 v4.16-1764224688, +4 more Red Hat Openshift Data Foundation 4.17 odf4 v4.17-1764174656, odf4 v4.17-1764174663, odf4 v4.17-1764174675, odf4 v4.17-1764174678, odf4 v4.17-1764174688, odf4 v4.17-1764174689, +6 more Red Hat Openshift Data Foundation 4.18 odf4 v4.18-1762335989, odf4 v4.18-1762335993, odf4 v4.18-1762335997, odf4 v4.18-1762335999, odf4 v4.18-1762336001, odf4 v4.18-1762336004, +6 more Red Hat Openshift Data Foundation 4.19 odf4 v4.19-1761845922, odf4 v4.19-1761845947, odf4 v4.19-1761845970, odf4 v4.19-1761845991, odf4 v4.19-1761846027, odf4 v4.19-1761846044, +7 more
    +2 more products
    Red Hat Openshift Data Foundation 4.20 odf4 v4.20-1762875806, odf4 v4.20-1762875810, odf4 v4.20-1762875812, odf4 v4.20-1762875816, odf4 v4.20-1762875818, odf4 v4.20-1762875825, +6 more Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.5.3.2-1.el8ev, ovirt-engine 4.5.3.2-1.el8ev, ovirt-engine-dwh 4.5.7-1.el8ev, ovirt-engine-setup 4.5.3.2-1.el8ev, ovirt-engine-tools 4.5.3.2-1.el8ev, ovirt-engine-backend 4.5.3.2-1.el8ev, +18 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.61% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • huntr.dev https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 8.0 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.0 8.0 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm follow-redirects
<1.14.7
1.14.7

Affected products

  • follow-redirects follow-redirects/follow-redirects

Classification

Weakness
  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.