GHSA-xjjg-vmw6-c2p9

Suggest an improvement
Source
https://github.com/advisories/GHSA-xjjg-vmw6-c2p9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-xjjg-vmw6-c2p9/GHSA-xjjg-vmw6-c2p9.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-xjjg-vmw6-c2p9
Aliases
Related
Published
2019-08-27T17:44:33Z
Modified
2024-09-20T21:40:56.982095Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Open Redirect in httpie
Details

All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.

Database specific
{
    "nvd_published_at": "2019-08-23T17:15:00Z",
    "cwe_ids": [
        "CWE-601"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2019-08-27T17:27:00Z"
}
References

Affected packages

PyPI / httpie

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.3

Affected versions

0.*

0.1
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4dev
0.2.4
0.2.5
0.2.6
0.2.7
0.3.0
0.3.1
0.4.0
0.4.1
0.5.0
0.5.1
0.6.0
0.7.0
0.7.2
0.8.0
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9

1.*

1.0.0
1.0.2