CVE-2018-25091

Katalog CVE

CVSS 6.1 · Medium EPSS 0,52%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada python urllib3. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

Rincian

Terbit di NVD

15 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/urllib3/urllib3/issues/1510 issue tracking · patch · advisory vendor
• https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc patch
• https://github.com/urllib3/urllib3/compare/1.24.1...1.24.2 patch