CVE-2022-24737

Katalog CVE

CVSS 6.5 · Medium EPSS 1,7%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada httpie, fedoraproject fedora. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.

Rincian

Terbit di NVD

7 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 75,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b patch · advisory pihak ketiga
• https://github.com/httpie/httpie/releases/tag/3.1.0 release notes · advisory pihak ketiga
• https://github.com/httpie/httpie/security/advisories/GHSA-9w4w-cpc8-h2fq exploit · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QZD2AZOL7XLN...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5VYSYKEKVZEV...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXFCHGTW3V32G...