CVE-2022-31070 json
Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy
published 2022-06-15 4 y ago modified 2026-06-17 4 mo ago also GHSA-77mv-4rg7-r8qv , EUVD-2022-5976
- cvss
- 5.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application developer. This could have led to sensitive cookies being inadvertently exposed to such services that should not see them. The patched version now blocks cookies from being forwarded by default. However developers can configure an allow-list of cookie names by using the `allowedCookies` config setting. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead.
Patch / fix
- npm @finastra/nestjs-proxy 0.7.0
- finastra nestjs-proxy 0.7.0
- github.com/Finastra/finastra-nodejs-libs#232 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.8 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 5.8 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @finastra/nestjs-proxy | <0.7.0 |
0.7.0 |
Affected products
- Finastra finastra-nodejs-libs
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/Finastra/finastra-nodejs-libs/pull/232
web, patch, third-party-advisory
-
github.com
/Finastra/finastra-nodejs-libs/security/advisories/GHSA-77mv-4rg7-r8qv
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-31070
advisory
-
github.com
/Finastra/finastra-nodejs-libs
package
Sources
- CVE List CVE-2022-31070
- GitHub Advisory GHSA-77mv-4rg7-r8qv
- NVD CVE-2022-31070
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.