CVE-2022-31033: medium-severity vulnerability in sparklemotion mechanize
Authorization header leak in rubygem Mechanize
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The Mechanize web automation library leaks the Authorization header (which contains sensitive credentials) when a website redirects you to a different port on the same domain. This means your login credentials could be exposed to an attacker who controls that alternate port.
CWE-200 information disclosure vulnerability in Mechanize versions before 2.8.5: the library fails to clear the Authorization header during cross-port redirects on the same host, allowing credentials to be transmitted to an unintended endpoint. Attack vector requires the application to follow a malicious redirect response; impact is credential exposure if the attacker controls the alternate port.
In the same product, most dangerous first.