CVE-2022-31043

Katalog CVE

CVSS 7.5 · High EPSS 2,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada guzzlephp guzzle, drupal +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.

Rincian

Terbit di NVD

10 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 79,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8 patch · advisory pihak ketiga
• https://www.drupal.org/sa-core-2022-011 patch · advisory pihak ketiga
• https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5246 advisory pihak ketiga
• https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx advisory pihak ketiga