Vulnerability Intelligence Report
CVE-2018-20060
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:4.49%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| python | urllib3 | all |
| fedoraproject | fedora | 28, 29, 30 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
4.488%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2018-12-11T00:00:00 |
| Published | 2018-12-11T17:00:00 |
| Patch Date | 2018-12-11 |
| Last Updated | 2024-12-27T16:02:59 |
Community Chatter & Buzz