Security readout for executives and security teams
Plain-English summary
Some PHP applications using Guzzle could unintentionally send manually added Cookie headers to the wrong place during redirects. That can expose session or authentication data if a redirect changes to another host or from HTTPS to HTTP.
Executive priority
Treat as a high-priority dependency update where Guzzle handles authenticated requests. The issue can leak sensitive cookies without user interaction, but sources do not indicate known active exploitation.
Technical view
Affected Guzzle versions did not always strip manually supplied Cookie headers when following redirects to a different host or an HTTP downgrade. Middleware-managed cookies were handled safely, but explicit Cookie headers could be forwarded. Fixed releases are 6.5.7 and 7.4.4.
Likely exposure
Exposure is most likely in PHP applications using guzzlehttp/guzzle before 6.5.7, or Guzzle 7 before 7.4.4, that manually set Cookie headers and allow redirects, especially to external or less trusted services.
Exploitation context
The source bundle does not show KEV listing or active exploitation. Abuse depends on an affected client following a redirect while a sensitive manual Cookie header is present. The impact is confidentiality loss, not integrity or availability.
Researcher notes
Focus review on explicit Cookie headers, redirect-following behavior, host changes, and HTTPS-to-HTTP downgrade cases. Do not assume all Guzzle cookie handling is vulnerable; the advisory distinguishes manual headers from cookie middleware behavior.
Mitigation direction
- Upgrade Guzzle 7 deployments to 7.4.4 or later.
- Upgrade older Guzzle series to 6.5.7, or migrate to 7.4.4 or later.
- Disable redirects where application flows do not require them.
- If unable to upgrade, use vendor-guided custom redirect middleware.
- Review downstream advisories for Drupal and Debian-managed packages.
Validation and detection
- Check Composer manifests and lockfiles for guzzlehttp/guzzle versions.
- Identify code paths that manually set Cookie headers on Guzzle requests.
- Confirm redirect handling is disabled or uses a fixed Guzzle release.
- Review dependency scanners for CVE-2022-31042 findings.
- Verify platform packages include Drupal or Debian security updates where relevant.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31042 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9CVE reference
- https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8CVE reference
- https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xxCVE reference
- https://www.drupal.org/sa-core-2022-011CVE reference
- DSA-5246CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.