High severity · published Jun 9, 2022
CVE-2022-31033
Authorization header leak in rubygem Mechanize
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
mechanize · sparklemotion
< 2.8.5 · source: vendor, NVD
FE
Fedora · Fedoraproject
35; 36 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31033
Patch
https://github.com/sparklemotion/mechanize/commit/c7fe6996a5b95f9880653ba3bc548a8d4ef72317
Third Party Advisory
https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OKZMR5O3T5HQ2V737TC7IU4WZRT2LGX/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA2FJROTX2U6EBWDPKRQ2VAM67A5TQXF/
More from mechanize
6.8
CVE-2026-107715
Mechanize sends credential headers to another host after an HTTP redirect
6.8
CVE-2026-107399
Mechanize sends credential headers to another origin after a meta refresh
5.9
CVE-2026-107714
Mechanize sends credential headers to a different scheme or port after a redirect