CVE-2022-31033

    Dashboard / Vulnerabilities / CVE-2022-31033

    CVE-2022-31033

    Published: 9 Jun 2022Last Modified: 12 Aug 2026

    Summary: Authorization header leak in rubygem Mechanize

    Details: The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31033.json, https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OKZMR5O3T5HQ2V737TC7IU4WZRT2LGX/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA2FJROTX2U6EBWDPKRQ2VAM67A5TQXF/, https://nvd.nist.gov/vuln/detail/CVE-2022-31033, https://github.com/sparklemotion/mechanize/commit/c7fe6996a5b95f9880653ba3bc548a8d4ef72317

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c1091fd4e3bce84f018b37a212dda6f670060154

    Affected versions

    v2.8.4
    v2.8.3
    v2.8.2
    v2.8.1
    v2.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31033 | CVE-DB