CVE-2018-18074

PoC ×2—

CVSS 3.1

7.5 high

EPSS

7%p94

Published

Oct 9, 2018 (Oct 9, 2018)

Modified

Jun 17, 2026

Description

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Vendors: python canonical opensuse redhat
Products: requests, ubuntu linux, leap, enterprise linux desktop, enterprise linux server, enterprise linux workstation
Weakness: CWE-522
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (7.4%)

In the news0 stories

No ingested article mentions this CVE yet.