In breve
- CVE-2022-24775 è una vulnerabilità ALTO (CVSS 7.5) che riguarda drupal/core, guzzlehttp/psr7, drupal (drupal).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.5%, superiore al 84.6% delle vulnerabilità.
- Correzione: aggiornare a 9.2.16, 9.3.9, 2.1.1, 1.8.4 o successiva.
| Package | Affected versions | Patched versions |
|---|
| drupal/core Packagist | ≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9
| 9.2.169.3.9
|
| guzzlehttp/psr7 Packagist | ≥ 2.0.0, < 2.1.1< 1.8.4
| 2.1.11.8.4
|
| drupal | ≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9
| 9.2.169.3.9
|
| psr-7 | ≥ 2.0.0, < 2.1.1< 1.8.4
| 2.1.11.8.4
|
Description
Impact
Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.
Patches
The issue is patched in 1.8.4 and 2.1.1.
Workarounds
There are no known workarounds.
References
NVD description
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free