CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.

Score

CVSS 3.1 5.3 Medium

Status

Modified - report@snyk.io

Published

2020-07-17

Last modified

2024-09-16

Weaknesses

CWE-200

Affected products

• React-native-fast-image (React-native-fast-image Project)

References

• https://github.com/DylanVann/react-native-fast-image/issues/690
• https://github.com/DylanVann/react-native-fast-image/pull/691
• https://snyk.io/vuln/SNYK-JS-REACTNATIVEFASTIMAGE-572228