CVE-2022-31033

The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub_MCNA
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
VendorProductVersion
mechanize_projectmechanize
𝑥
< 2.8.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-mechanize
bullseye
no-dsa
buster
no-dsa
bookworm
2.8.5-1
fixed
sid
2.10.1-1
fixed
trixie
2.10.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-mechanize
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
not-affected
impish
not-affected
focal
not-affected
bionic
not-affected
xenial
not-affected
trusty
ignored