Skip to main content

Insufficiently Protected Credentials

CVE-2024-47081

Medium
5.3/10

Summary

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak ".netrc" credentials to third parties for specific maliciously crafted URLs. For older versions of Requests, use of the ".netrc" file can be disabled with "trust_env=False" on one's Requests Session.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • NONE

CWE-522 - Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References

Advisory Timeline

  • Published