GitHub Advisoryadvisory · RubyGems

GHSA-64qm-hrgp-pgr9 Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect

MEDIUM Published 2022-06-09 Modified 2022-07-21 Official page ↗
Aliases
CVE-2022-31033
Ecosystem
RubyGems
Packages
mechanize
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-522
Reviewed
2022-06-09

Affected packages

• RubyGems mechanize: < 2.8.5 → fixed in 2.8.5

Description

Summary Mechanize (rubygem) ` Cookies do not provide isolation by port. If a cookie is readable > by a service running on one port, the cookie is also readable by a > service running on another port of the same server. If a cookie is > writable by a service on one port, the cookie is also writable by a > service running on another port of the same server. For this > reason, servers SHOULD NOT both run mutually distrusting services on > different ports of the same host and use cookies to store security- > sensitive information.

Related

Alias · CVE (1)

  • CVE-2022-31033 The Mechanize library is used for automating interaction with websites. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References