Exposure of Private Personal Information to an Unauthorized Actor in lquixada/cross-fetch
Priority LOW 31CWE-359Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-359 and CWE-863.
Summary
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.
Why it matters now
EPSS 0.01172 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial lquixada/cross-fetch (lquixada): 3.1.5Red Hat: 3 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lquixada | lquixada/cross-fetch | before 3.1.5 | 3.1.5 | Patch available | CNA |
- lquixada/cross-fetch Vendorlquixada Affected before 3.1.5 Fixed in 3.1.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cross-fetch_project:cross-fetch:*:*:*:*:*:node.js:*:* | before 3.1.5 | Vulnerable | Cross-fetch Project |
- cpe:2.3:a:cross-fetch_project:cross-fetch:*:*:*:*:*:node.js:*:* Versions before 3.1.5 Vulnerable ·Cross-fetch Project
Remediation
- Fix · CNA lquixada/cross-fetch (lquixada) Fixed in 3.1.5
Red Hat 3 advisories
- RHSA-2022:6813 Released 2022-10-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.1 security update
- RHPAM 7.13.1 async
- RHSA-2022:5840 Released 2022-08-02 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.3 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8 +7
- RHSA-2022:1681 Released 2022-05-03 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:5840 |
| RHPAM 7.13.1 async | Fixed | RHSA-2022:6813 |
Not affected: 8 products
- 8Base-RHMTC-1.7
- OpenShift Developer Tools and Services
- OpenShift Service Mesh 2.1
- Red Hat 3scale API Management Platform 2
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Application Runtimes
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1365
References
Sources
- CVE-2022-1365 · CVE Program
- CVE-2022-1365 · NVD
- FIRST EPSS
- CVE-2022-1365 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences