Logo
Retour à la veille

CVE-2026-59883

Publié : 8 juillet 2026
Modifié : 8 juillet 2026
Lien officiel NVD
Score CVSS
4.7
MEDIUM

Description détaillée

Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Références et Patchs

https://github.com/guzzle/guzzle/commit/b9944c161b12d9ee9c9334cfc5b9659ecd7451f8https://github.com/guzzle/guzzle/pull/3694https://github.com/guzzle/guzzle/releases/tag/7.12.3https://github.com/guzzle/guzzle/security/advisories/GHSA-g446-98w2-8p5w

Dernières Vulnérabilités

CVE-2026-8801

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

VOIR DÉTAILS

CVE-2026-8800

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

VOIR DÉTAILS

CVE-2026-8651

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

VOIR DÉTAILS