pysec - pysec-2022-167

pysec-2022-167

Vulnerability from pysec

Published

2022-03-15 15:15

Modified

2022-03-23 14:28

Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.

Impacted products

Name	purl
httpie	pkg:pypi/httpie

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "httpie",
        "purl": "pkg:pypi/httpie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "65ab7d5caaaf2f95e61f9dd65441801c2ddee38b"
            }
          ],
          "repo": "https://github.com/httpie/httpie",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1",
        "0.1.1",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.4dev",
        "0.2.5",
        "0.2.6",
        "0.2.7",
        "0.3.0",
        "0.3.1",
        "0.4.0",
        "0.4.1",
        "0.5.0",
        "0.5.1",
        "0.6.0",
        "0.7.0",
        "0.7.2",
        "0.8.0",
        "0.9.0",
        "0.9.1",
        "0.9.2",
        "0.9.3",
        "0.9.4",
        "0.9.5",
        "0.9.6",
        "0.9.7",
        "0.9.8",
        "0.9.9",
        "1.0.0",
        "1.0.2",
        "1.0.3",
        "2.0.0",
        "2.1.0",
        "2.2.0",
        "2.3.0",
        "2.4.0",
        "2.5.0",
        "2.6.0",
        "3.0.0",
        "3.0.1",
        "3.0.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0430",
    "GHSA-6pc9-xqrg-wfqw"
  ],
  "details": "Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.",
  "id": "PYSEC-2022-167",
  "modified": "2022-03-23T14:28:20.245559Z",
  "published": "2022-03-15T15:15:00Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6pc9-xqrg-wfqw"
    }
  ]
}

ghsa-6pc9-xqrg-wfqw

Vulnerability from github

Published

2022-03-16 00:00

Modified

2024-11-18 16:26

Severity ?

2.4 (Low) - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
4.8 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

Exposure of Sensitive information in httpie

Details

httpie is a modern, user-friendly command-line HTTP client for the API era. Prior to version 3.1.0, all cookies saved to session storage are supercookies. At this time, there is no known workaround. Users are recommended to update to version 3.1.0.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "httpie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0430"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-19T00:00:15Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "httpie is a modern, user-friendly command-line HTTP client for the API era. Prior to version 3.1.0, all cookies saved to session storage are supercookies. At this time, there is no known workaround. Users are recommended to update to version 3.1.0.",
  "id": "GHSA-6pc9-xqrg-wfqw",
  "modified": "2024-11-18T16:26:20Z",
  "published": "2022-03-16T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6pc9-xqrg-wfqw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/httpie/httpie"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/httpie/PYSEC-2022-167.yaml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Exposure of Sensitive information in httpie"
}

CVE-2022-0430 (GCVE-0-2022-0430)

Vulnerability from cvelistv5

Published

2022-03-15 14:20

Modified

2024-08-02 23:25

Severity ?

2.4 (Low) - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Summary

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.

References

▼	URL	Tags
	https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b	x_refsource_MISC
	https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	httpie	httpie/httpie	Version: unspecified < 3.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:25:40.480Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "httpie/httpie",
          "vendor": "httpie",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-15T14:20:16",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f"
        }
      ],
      "source": {
        "advisory": "dafb2e4f-c6b6-4768-8ef5-b396cd6a801f",
        "discovery": "EXTERNAL"
      },
      "title": "Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0430",
          "STATE": "PUBLIC",
          "TITLE": "Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "httpie/httpie",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "httpie"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b",
              "refsource": "MISC",
              "url": "https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b"
            },
            {
              "name": "https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f"
            }
          ]
        },
        "source": {
          "advisory": "dafb2e4f-c6b6-4768-8ef5-b396cd6a801f",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0430",
    "datePublished": "2022-03-15T14:20:16",
    "dateReserved": "2022-01-31T00:00:00",
    "dateUpdated": "2024-08-02T23:25:40.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2022-167

Vulnerability from pysec

ghsa-6pc9-xqrg-wfqw

Vulnerability from github

CVE-2022-0430 (GCVE-0-2022-0430)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature