PT-2022-20476 · Mechanize+2 · Mechanize+2

Flavorjones · Published 2022-06-09 · Updated 2024-07-27 · CVE-2022-31033

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mechanize versions prior to 2.8.5

Description The Mechanize library, used for automating interaction with websites, has an issue where the Authorization header is leaked after a redirect to a different port on the same site. This occurs in versions prior to 2.8.5. The library automatically stores and sends cookies, follows redirects, and can follow links and submit forms.

Recommendations For Mechanize versions prior to 2.8.5, upgrade to Mechanize v2.8.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information that could be leaked due to the Authorization header issue, until a patch is applied.

Exploit

Fix

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

ALT-PU-2023-1339

ALT-PU-2023-4274

ALT-PU-2024-7821

CVE-2022-31033

GHSA-64QM-HRGP-PGR9

Affected Products

Alt Linux

Debian

Mechanize

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31033.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mechanize/CVE-2022-31033.yml · Exploit
• https://github.com/sparklemotion/mechanize/commit/c7fe6996a5b95f9880653ba3bc548a8d4ef72317 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA2FJROTX2U6EBWDPKRQ2VAM67A5TQXF · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OKZMR5O3T5HQ2V737TC7IU4WZRT2LGX · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31033 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31033 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31033 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31033 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31033 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-64qm-hrgp-pgr9 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31033 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31033 · Security Note
• https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9 · Note
• https://github.com/sparklemotion/mechanize/commit/17e5381032c90caf240ac3d2e52b353f40c18d83 · Note