Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2022-31043

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
10/06/2022
Last modified:
24/07/2023

Description

Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.

Impact

Vector 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v3.1 Severity and Metrics:

Base Score: 7.50 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): None
Availability (A): None

Base Score 3.x
7.50
Severity 3.x
HIGH
Vector 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:N CVSS v2.0 Severity and Metrics:

Base Score: 5.00 MEDIUM
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): None
Availability (A): None

Base Score 2.0
5.00
Severity 2.0
MEDIUM

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* 6.5.7 (excluding)
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* 7.0.0 (including) 7.4.4 (excluding)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* 9.2.0 (including) 9.2.21 (excluding)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* 9.3.0 (including) 9.3.16 (excluding)
cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools