CVE-2018-18074

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which…

published October 9, 2018

CVSS
—
EPSS
7%
Percentile
94.4
In the wild
Unconfirmed
What it is

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07443 · 94.4th percentile
Published
2018-10-09T15:00Z
EPSS history
Timeline
  • 09 OCT 15:00Z
    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which…
    cvelistv5