Vulnerability from drupal
Published
2025-12-17 17:47
Modified
2025-12-17 17:47
Summary
Details

Http Client Manager introduces a new Guzzle based plugin which allows you to manage HTTP clients using Guzzle Service Descriptions via YAML, JSON or PHP files, in a simple and efficient way. The modules allows administrators to configure HTTP requests as part of Event Condition Action (ECA) automation.

The module does not sufficiently maintain separation of data from request operations, potentially leading to information disclosure in very uncommon situations.

Credits
mxh www.drupal.org/u/mxh
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c9.3.13 || \u003e=10.0.0 \u003c10.0.2 || \u003e=11.0.0 \u003c11.0.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/http_client_manager"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c9.3.13"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.3.13"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=10.0.0 \u003c10.0.2"
          },
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=11.0.0 \u003c11.0.1"
          },
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2025-14840"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/mxh"
      ],
      "name": "mxh"
    }
  ],
  "details": "Http Client Manager introduces a new Guzzle based plugin which allows you to manage HTTP clients using Guzzle Service Descriptions via YAML, JSON or PHP files, in a simple and efficient way. The modules allows administrators to configure HTTP requests as part of Event Condition Action (ECA) automation.\n\nThe module does not sufficiently maintain separation of data from request operations, potentially leading to information disclosure in very uncommon situations.",
  "id": "DRUPAL-CONTRIB-2025-126",
  "modified": "2025-12-17T17:47:13.000Z",
  "published": "2025-12-17T17:47:13.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2025-126"
    }
  ],
  "schema_version": "1.7.0"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.