Search for vulnerabilities
Vulnerability details: VCID-7ycs-sa7m-aaar
Vulnerability ID VCID-7ycs-sa7m-aaar
Aliases CVE-2022-31042
GHSA-f2wf-25xc-69c9
Summary Failure to strip the Cookie header on change in host or HTTP downgrade
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00303 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00303 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00303 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00303 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00303 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00324 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00328 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00328 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00376 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00376 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00376 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00389 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.00451 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
epss 0.01323 https://api.first.org/data/v1/epss?cve=CVE-2022-31042
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-f2wf-25xc-69c9
cvssv3.1 7.7 https://github.com/guzzle/guzzle
generic_textual HIGH https://github.com/guzzle/guzzle
cvssv3.1 7.5 https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
generic_textual HIGH https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
ssvc Track https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
cvssv3.1 7.5 https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
cvssv3.1_qr HIGH https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
generic_textual HIGH https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
ssvc Track https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2022-31042
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-31042
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-31042
archlinux Unknown https://security.archlinux.org/AVG-2823
cvssv3.1 7.5 https://www.debian.org/security/2022/dsa-5246
cvssv3.1 7.7 https://www.debian.org/security/2022/dsa-5246
generic_textual HIGH https://www.debian.org/security/2022/dsa-5246
ssvc Track https://www.debian.org/security/2022/dsa-5246
cvssv3.1 7.5 https://www.drupal.org/sa-core-2022-011
generic_textual HIGH https://www.drupal.org/sa-core-2022-011
ssvc Track https://www.drupal.org/sa-core-2022-011
cvssv3.1 7.5 https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
generic_textual HIGH https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
ssvc Track https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-31042
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44854
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44855
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44856
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28201
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28202
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28203
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29248
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31042
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31043
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31090
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31091
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34912
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41765
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41767
https://github.com/guzzle/guzzle
https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
https://www.debian.org/security/2022/dsa-5246
https://www.drupal.org/sa-core-2022-011
https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
1012821 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012821
AVG-2823 https://security.archlinux.org/AVG-2823
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CVE-2022-31042 https://nvd.nist.gov/vuln/detail/CVE-2022-31042
CVE-2022-31042.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31042.yaml
GHSA-f2wf-25xc-69c9 https://github.com/advisories/GHSA-f2wf-25xc-69c9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31042
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31042
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31042
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.debian.org/security/2022/dsa-5246
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://www.debian.org/security/2022/dsa-5246
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://www.debian.org/security/2022/dsa-5246
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.drupal.org/sa-core-2022-011
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://www.drupal.org/sa-core-2022-011
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:32Z/ Found at https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Exploit Prediction Scoring System (EPSS)
Percentile 0.60751
EPSS Score 0.00231
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.