CVE-2023-45289 | BDVDB-2026-226532 Detail

Description#

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12024-03-05Record published in the CVE List.
2. Version 22025-02-13Most recent update recorded in the CVE List.