CVEvulnerability
CVE-2019-10751
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-08-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-601
Description
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
Affected configurations
• httpie httpie
Related
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00003.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00022.html lists.opensuse.org
- https://github.com/jakubroztocil/httpie/releases/tag/1.0.3 Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00031.html lists.debian.org
- https://snyk.io/vuln/SNYK-PYTHON-HTTPIE-460107 Exploit, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00003.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00022.html lists.opensuse.org
- https://github.com/jakubroztocil/httpie/releases/tag/1.0.3 Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00031.html lists.debian.org
- https://snyk.io/vuln/SNYK-PYTHON-HTTPIE-460107 Exploit, Third Party Advisory