-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of Authorization headers during HTTPS→HTTP redirects. The commit diff shows the fix involved adding scheme validation in shouldStripSensitiveHeaders() and modifying redirectUri(). The original modifyRequest() only checked host changes (getHost() comparison), leaving scheme downgrades unhandled. The redirectUri method's non-static implementation might have contributed to improper URI resolution context.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| guzzlehttp/guzzle | composer | >= 7.0.0, < 7.4.4 | 7.4.4 |
| guzzlehttp/guzzle | composer | >= 4.0.0, < 6.5.7 | 6.5.7 |