Em resumo
- CVE-2022-24775 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta drupal/core, guzzlehttp/psr7, drupal (drupal).
- Chance de exploração nos próximos 30 dias (EPSS): 2.5%, maior que 84.6% das vulnerabilidades.
- Correção: atualize para 9.2.16, 9.3.9, 2.1.1, 1.8.4 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| drupal/core Packagist | ≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9
| 9.2.169.3.9
|
| guzzlehttp/psr7 Packagist | ≥ 2.0.0, < 2.1.1< 1.8.4
| 2.1.11.8.4
|
| drupal | ≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9
| 9.2.169.3.9
|
| psr-7 | ≥ 2.0.0, < 2.1.1< 1.8.4
| 2.1.11.8.4
|
Description
Impact
Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.
Patches
The issue is patched in 1.8.4 and 2.1.1.
Workarounds
There are no known workarounds.
References
NVD description
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free