CyberRota Analysis
AI-GeneratedVersions of guzzlehttp/guzzle prior to 7.15.1 are vulnerable due to improper handling of host-only cookie scope, allowing attackers controlling child hosts to access sensitive cookies intended for parent hosts. This misconfiguration can lead to the exposure of session identifiers and authorization tokens, particularly when cookie jars are shared across different trust boundaries. Organizations using affected versions should prioritize updating to mitigate the risk of session hijacking and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.