Lucene search

[email protected]CVE-2022-24737

HistoryMar 07, 2022 - 11:15 p.m.

CVE-2022-24737

2022-03-0723:15:07

CWE-200

[email protected]

web.nvd.nist.gov

httpie

cve-2022-24737

command-line http client

security vulnerability

session management

upgrade advisory

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.9%

JSON

HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.

Affected configurations

Vulners

NVD

Node

httpiehttpieRange<3.1.0

VendorProductVersionCPE
httpiehttpie*cpe:2.3:a:httpie:httpie:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
httpie	httpie	*	cpe:2.3:a:httpie:httpie::::::::

CNA Affected

[
  {
    "product": "httpie",
    "vendor": "httpie",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.1.0"
      }
    ]
  }
]