Information Disclosure

2022-06-2803:49:38

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

guzzlehttp/guzzle

vulnerability

information disclosure

redirectmiddleware.php

curlopt_httpauth

authorization header

malicious urls

security

EPSS

0.002

Percentile

61.2%

JSON

guzzlehttp/guzzle is vulnerable to information disclosure. The vulnerability exists because the checkRedirect function of RedirectMiddleware.php does not properly clear the CURLOPT_HTTPAUTH option on a change of origin, allowing an attacker to get sensitive information through the Authorization header by redirecting to the malicious urls.