Orta CVSS 6.5
CVE-2026-8368: CVE-2026-8368: güvenlik açığı
Açıklama (NVD)
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes. A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.
Özet bilgiler
- CVSS v3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS
- %0,27 (yüzdelik 19)
- CWE
- CWE-522
- Yama
- Yok / bilinmiyor