Threats tagged 'ghsa-wgw5-9p87-vhvp'

A vulnerability in the ScopingHttpClient component of Symfony HttpClient allows credentials from a default scope to be sent to an attacker-controlled server when a network-path reference URL is resolved outside the base URI's origin. This occurs in Symfony versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The issue arises because merged options like auth_bearer or auth_basic are retained even when the resolved URL points to a different origin, potentially exposing sensitive credentials.