Improperly implemented security check for standard in guzzle - CVE-2022-31042
Published: June 10, 2022
Vulnerability identifier: #VU64188
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-31042
CWE-ID: CWE-358
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The
vulnerability exists due to insecure implementation when handling HTTPS
to HTTP redirects. The application includes "Cookie" header into
request if the target server responds with a redirect to a URI with the
`http` scheme, or on making a
request to a server which responds with a redirect to a a URI to a
different host. As a result a remote attacker can obtain the
authentication cookie and compromise the affected application.
Affected software
guzzle
Drupal
Drupal
How to mitigate CVE-2022-31042
Install updates from vendor's website.
guzzle - addressed in versions 6.5.7, 7.4.4
Drupal - addressed in versions 9.2.21, 9.3.16, 9.4.0 rc2
Drupal - addressed in versions 9.2.21, 9.3.16, 9.4.0 rc2