Search for vulnerabilities
Vulnerability details: VCID-q2yr-bwum-23f2
Vulnerability ID VCID-q2yr-bwum-23f2
Aliases CVE-2022-31043
GHSA-w248-ffj2-4v5q
Summary Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
CWE-863 Incorrect Authorization
System Score Found at
epss 0.00573 https://api.first.org/data/v1/epss?cve=CVE-2022-31043
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-w248-ffj2-4v5q
cvssv3.1 7.5 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31043.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31043.yaml
cvssv3.1 7.5 https://github.com/guzzle/guzzle
generic_textual HIGH https://github.com/guzzle/guzzle
cvssv3.1 7.5 https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
generic_textual HIGH https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
ssvc Track https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
cvssv3.1 7.5 https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q
cvssv3.1_qr HIGH https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q
generic_textual HIGH https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q
ssvc Track https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2022-31043
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-31043
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-31043
archlinux Unknown https://security.archlinux.org/AVG-2823
cvssv3.1 7.5 https://www.debian.org/security/2022/dsa-5246
generic_textual HIGH https://www.debian.org/security/2022/dsa-5246
ssvc Track https://www.debian.org/security/2022/dsa-5246
cvssv3.1 7.5 https://www.drupal.org/sa-core-2022-011
generic_textual HIGH https://www.drupal.org/sa-core-2022-011
ssvc Track https://www.drupal.org/sa-core-2022-011
cvssv3.1 7.5 https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
generic_textual HIGH https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
ssvc Track https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-31043
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44854
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44855
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44856
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28201
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28202
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28203
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29248
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31042
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31043
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31090
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31091
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34912
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41765
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41767
https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31043.yaml
https://github.com/guzzle/guzzle
https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q
https://nvd.nist.gov/vuln/detail/CVE-2022-31043
https://www.debian.org/security/2022/dsa-5246
https://www.drupal.org/sa-core-2022-011
https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
1012821 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012821
AVG-2823 https://security.archlinux.org/AVG-2823
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
GHSA-w248-ffj2-4v5q https://github.com/advisories/GHSA-w248-ffj2-4v5q
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31043.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:28Z/ Found at https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:28Z/ Found at https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31043
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31043
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.debian.org/security/2022/dsa-5246
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:28Z/ Found at https://www.debian.org/security/2022/dsa-5246
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.drupal.org/sa-core-2022-011
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:28Z/ Found at https://www.drupal.org/sa-core-2022-011
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:54:28Z/ Found at https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx
Exploit Prediction Scoring System (EPSS)
Percentile 0.67675
EPSS Score 0.00573
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T11:52:42.996022+00:00 Arch Linux Importer Import https://security.archlinux.org/AVG-2823 36.1.3