CVE-2020-11021 - CVE House
Back to Database
Status published Medium CVE-2020-11021

HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client

Vulnerability Description

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-11021

Credits & Attribution

No credits recorded in the NVD database.

References

More from actions

View All →
CVE-2025-5890
actions toolkit glob internal-pattern.ts globEscape redos
Medium 5.3
CVE-2024-42471
Arbitrary File Write via artifact extraction in actions/artifact
High 7.3
CVE-2022-39321
GitHub Actions Runner vulnerable to Docker Command Escaping
High 8.8
CVE-2022-35954
Delimiter injection vulnerability in @actions/core exportVariable
Medium 5
CVE-2020-15228
Environment Variable Injection in GitHub Actions
Low 3.5

Affected Vendor

Affected Software

http-client
Vulnerable Versions:
< 1.0.8

Timeline

Official Publish: April 29th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration