TI-2022-00354 Aliases CVE-2022-0430 GHSA-6pc9-xqrg-wfqw

Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie

LOW 27CWE-200Published 2022-03-15 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.

Why it matters now

EPSS 0.01292 70th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed httpie/httpie (httpie): 3.1.0httpie (PyPI): 3.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
httpie	httpie/httpie	before 3.1.0	3.1.0	Patch available	CNA
—	httpie (PyPI)	before 3.1.0	3.1.0	Patch available	GHSA-6pc9-xqrg-wfqw

httpie/httpie Vendorhttpie Affected before 3.1.0 Fixed in 3.1.0 Patch available CNA
httpie (PyPI) Vendor— Affected before 3.1.0 Fixed in 3.1.0 Patch available GHSA-6pc9-xqrg-wfqw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:httpie:httpie::::::::	before 3.1.0	Vulnerable	httpie

cpe:2.3:a:httpie:httpie:*:*:*:*:*:*:*:* Versions before 3.1.0 Vulnerable ·httpie

Remediation

Fix · CNA httpie/httpie (httpie) Fixed in 3.1.0
Fix · GHSA-6pc9-xqrg-wfqw httpie (PyPI) Fixed in 3.1.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-0430
2026-10-03 Alias added: GHSA-6pc9-xqrg-wfqw

References

Exploit 1

https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f

Patch 1

https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b

Advisory 2

Other 2

TI-2022-08551 Exposure of Sensitive Information to an Unauthorized Actor in httpie CVSS 3.1MEDIUM 6.5
TI-2019-08016 Open redirect in HTTPIE CVSS 3.0HIGH 8.8
TI-2023-26015 Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on… CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences