Search for vulnerabilities
Vulnerability details: VCID-7xjw-zp9z-2qh7
Vulnerability ID VCID-7xjw-zp9z-2qh7
Aliases CVE-2022-31042
GHSA-f2wf-25xc-69c9
Summary Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach to use your own redirect middleware, rather than ours. If you do not require or expect redirects to be followed, one should simply disable redirects all together.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
System Score Found at
epss 0.00376 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-f2wf-25xc-69c9
cvssv3.1 7.5 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31042.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31042.yaml
cvssv3.1 7.5 https://github.com/guzzle/guzzle
generic_textual HIGH https://github.com/guzzle/guzzle
cvssv3.1 7.5 https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
generic_textual HIGH https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
ssvc Track https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
cvssv3.1 7.5 https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
cvssv3.1_qr HIGH https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
generic_textual HIGH https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
ssvc Track https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2022-31042
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-31042
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-31042
archlinux Unknown https://security.archlinux.org/AVG-2823
cvssv3.1 7.5 https://www.debian.org/security/2022/dsa-5246
generic_textual HIGH https://www.debian.org/security/2022/dsa-5246
ssvc Track https://www.debian.org/security/2022/dsa-5246
cvssv3.1 7.5 https://www.drupal.org/sa-core-2022-011
generic_textual HIGH https://www.drupal.org/sa-core-2022-011
ssvc Track https://www.drupal.org/sa-core-2022-011
cvssv3.1 7.5 https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
generic_textual HIGH https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
ssvc Track https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-31042
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44854
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44855
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44856
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28201
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28202
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28203
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29248
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31042
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31043
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31090
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31091
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34912
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41765
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41767
https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31042.yaml
https://github.com/guzzle/guzzle
https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
https://nvd.nist.gov/vuln/detail/CVE-2022-31042
https://www.debian.org/security/2022/dsa-5246
https://www.drupal.org/sa-core-2022-011
https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
1012821 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012821
AVG-2823 https://security.archlinux.org/AVG-2823
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
GHSA-f2wf-25xc-69c9 https://github.com/advisories/GHSA-f2wf-25xc-69c9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31042.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31042
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31042
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.debian.org/security/2022/dsa-5246
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://www.debian.org/security/2022/dsa-5246
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.drupal.org/sa-core-2022-011
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://www.drupal.org/sa-core-2022-011
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Exploit Prediction Scoring System (EPSS)
Percentile 0.58341
EPSS Score 0.00376
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T11:52:43.011381+00:00 Arch Linux Importer Import https://security.archlinux.org/AVG-2823 36.1.3