CVE-2025-14840
HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126
Summary
HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126
Original description
The description as published by the source.
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/http_client_manager
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.13"}],"database_specific":{"constraint":"<9.3.13"}},{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.2"}],"database_specific":{"constraint":">=10.0.0 <10.0.2"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.1"}],"database_specific":{"constraint":">=11.0.0 <11.0.1"}}]
References
- advisory github.com
- advisory nvd.nist.gov
- web drupal.org
- web git.drupalcode.org
- web drupal.org