Search for vulnerabilities
Vulnerability details: VCID-3s2w-ytft-aaar
Vulnerability ID VCID-3s2w-ytft-aaar
Aliases CVE-2018-20060
GHSA-www2-v7xj-xrc6
PYSEC-2018-32
Summary urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-522 Insufficiently Protected Credentials
System Score Found at
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
cvssv3.1 9.8 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
generic_textual CRITICAL http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-20060.html
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2019:2272
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2019:2272
rhas Moderate https://access.redhat.com/errata/RHSA-2019:2272
rhas Moderate https://access.redhat.com/errata/RHSA-2020:0850
rhas Moderate https://access.redhat.com/errata/RHSA-2020:0851
rhas Moderate https://access.redhat.com/errata/RHSA-2020:1605
rhas Moderate https://access.redhat.com/errata/RHSA-2020:1916
rhas Moderate https://access.redhat.com/errata/RHSA-2020:2068
rhas Moderate https://access.redhat.com/errata/RHSA-2020:2081
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-20060.json
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00481 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00494 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00494 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00494 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00504 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00949 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.00975 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
epss 0.01873 https://api.first.org/data/v1/epss?cve=CVE-2018-20060
cvssv3.1 9.8 https://bugzilla.redhat.com/show_bug.cgi?id=1649153
generic_textual CRITICAL https://bugzilla.redhat.com/show_bug.cgi?id=1649153
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20060
cvssv3 2.6 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-www2-v7xj-xrc6
cvssv3.1 9.8 https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml
cvssv3.1 9.8 https://github.com/urllib3/urllib3
generic_textual CRITICAL https://github.com/urllib3/urllib3
cvssv3.1 7.5 https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
cvssv3.1 9.8 https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
generic_textual CRITICAL https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
generic_textual HIGH https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
cvssv3.1 9.8 https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532
generic_textual CRITICAL https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532
cvssv3.1 9.8 https://github.com/urllib3/urllib3/issues/1316
generic_textual CRITICAL https://github.com/urllib3/urllib3/issues/1316
cvssv3.1 9.8 https://github.com/urllib3/urllib3/pull/1346
generic_textual CRITICAL https://github.com/urllib3/urllib3/pull/1346
cvssv3.1 6.5 https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
generic_textual CRITICAL https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
cvssv3.1 9.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
cvssv3.1 9.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
cvssv3.1 9.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
cvssv3.1 9.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
cvssv3.1 9.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
cvssv3.1 9.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2018-20060
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2018-20060
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2018-20060
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2018-20060
cvssv3.1 9.8 https://security.netapp.com/advisory/ntap-20241227-0010
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20241227-0010
generic_textual Medium https://ubuntu.com/security/notices/USN-3990-1
cvssv3.1 7.5 https://usn.ubuntu.com/3990-1
cvssv3.1 9.8 https://usn.ubuntu.com/3990-1
generic_textual CRITICAL https://usn.ubuntu.com/3990-1
generic_textual HIGH https://usn.ubuntu.com/3990-1
generic_textual Low https://usn.ubuntu.com/usn/usn-3990-1
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-20060.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-20060.json
https://api.first.org/data/v1/epss?cve=CVE-2018-20060
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20060
https://cwe.mitre.org/data/definitions/288.html
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml
https://github.com/urllib3/urllib3
https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532
https://github.com/urllib3/urllib3/issues/1316
https://github.com/urllib3/urllib3/pull/1346
https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/
https://security.netapp.com/advisory/ntap-20241227-0010
https://security.netapp.com/advisory/ntap-20241227-0010/
https://ubuntu.com/security/notices/USN-3990-1
https://usn.ubuntu.com/3990-1
https://usn.ubuntu.com/3990-1/
https://usn.ubuntu.com/usn/usn-3990-1
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
CVE-2018-20060 https://nvd.nist.gov/vuln/detail/CVE-2018-20060
GHSA-www2-v7xj-xrc6 https://github.com/advisories/GHSA-www2-v7xj-xrc6
RHBA-2020:1540 https://bugzilla.redhat.com/show_bug.cgi?id=1649153
RHSA-2019:2272 https://access.redhat.com/errata/RHSA-2019:2272
RHSA-2020:0850 https://access.redhat.com/errata/RHSA-2020:0850
RHSA-2020:0851 https://access.redhat.com/errata/RHSA-2020:0851
RHSA-2020:1605 https://access.redhat.com/errata/RHSA-2020:1605
RHSA-2020:1916 https://access.redhat.com/errata/RHSA-2020:1916
RHSA-2020:2068 https://access.redhat.com/errata/RHSA-2020:2068
RHSA-2020:2081 https://access.redhat.com/errata/RHSA-2020:2081
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2019:2272
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-20060.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1649153
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/urllib3/urllib3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/urllib3/urllib3/issues/1316
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/urllib3/urllib3/pull/1346
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-20060
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-20060
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-20060
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20241227-0010
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://usn.ubuntu.com/3990-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://usn.ubuntu.com/3990-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.74989
EPSS Score 0.00457
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.