Log in Start free

Vulnerability · Published Jun 9, 2022 · Assigned by GitHub_M

CVE-2022-31033Authorization header leak in rubygem Mechanize

Medium 5.9

In plain English

A medium-severity information exposure in mechanize from sparklemotion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)1.5%top 25.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-mechanize2.8.5-1DEBIAN-CVE-2022-31033
Debian:13ruby-mechanize2.8.5-1DEBIAN-CVE-2022-31033
Debian:14ruby-mechanize2.8.5-1DEBIAN-CVE-2022-31033
RubyGemsmechanize2.8.5GHSA-64qm-hrgp-pgr9
Ubuntu:24.04:LTSruby-mechanizeno fix listedUBUNTU-CVE-2022-31033
Ubuntu:25.10ruby-mechanizeno fix listedUBUNTU-CVE-2022-31033
Ubuntu:26.04:LTSruby-mechanizeno fix listedUBUNTU-CVE-2022-31033
Ubuntu:26.10ruby-mechanizeno fix listedUBUNTU-CVE-2022-31033

Affected products (as reported)

VendorProductVersions
sparklemotion mechanize < 2.8.5

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References