CVE-2022-29248

Katalog CVE

CVSS 8.1 · High EPSS 1,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada guzzlephp guzzle, drupal +1 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.

Rincian

Terbit di NVD

25 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-565: Reliance on Cookies without Validation and Integrity Checking

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/guzzle/guzzle/commit/74a8602c6faec9ef74b7a9391ac82c5e65b1cdab patch · advisory pihak ketiga
• https://github.com/guzzle/guzzle/pull/3018 issue tracking · patch · advisory pihak ketiga
• https://www.drupal.org/sa-core-2022-010 patch · advisory pihak ketiga
• https://github.com/guzzle/guzzle/security/advisories/GHSA-cwmx-hcrq-mhc3 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5246 advisory pihak ketiga