-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper handling of manually added Cookie headers during redirects. The key changes in the fix:- 1) Introduction of shouldStripSensitiveHeaders static method to check host/scheme changes 2) Modified modifyRequest to remove both Authorization and Cookie headers based on this check 3) Made redirectUri static. The original vulnerability existed because the Cookie header wasn't being stripped in redirects to different hosts or HTTP downgrades, which was addressed by adding the sensitive header stripping logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| guzzlehttp/guzzle | composer | >= 7.0.0, < 7.4.4 | 7.4.4 |
| guzzlehttp/guzzle | composer | >= 4.0.0, < 6.5.7 | 6.5.7 |
A Semantic Attack on Google Gemini - Read the Latest Research