CVE-2022-31033 is a high-severity vulnerability affecting the Mechanize library (versions prior to 2.8.5) and related Fedora projects, where the Authorization header can be inadvertently leaked after a redirect to a different port on the same site. With a CVSS score of 7.5, this issue presents a network-based, low-complexity attack vector that could lead to a complete compromise of confidentiality. There is no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability. Users are advised to upgrade to Mechanize v2.8.5 or later as no workarounds exist.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.8.5CPE matchmatch criteria | cpe:2.3:a:mechanize_project:mechanize:*:*:*:*:*:ruby:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | ||
36CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.