CVE-2018-25091

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or…

published October 15, 2023

CVSS
—
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00594 · 47.7th percentile
Published
2023-10-15T00:00Z
EPSS history
Timeline
  • 15 OCT 00:00Z
    urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or…
    cvelistv5