DRUPAL-CONTRIB-2025-126
The advisory, in context
Http Client Manager introduces a new Guzzle based plugin which allows you to manage HTTP clients using Guzzle Service Descriptions via YAML, JSON or PHP files, in a simple and efficient way. The modules allows administrators to configure HTTP requests as part of Event Condition Action (ECA) automation.
The module does not sufficiently maintain separation of data from request operations, potentially leading to information disclosure in very uncommon situations.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 9.3.13
Fixed in 9.3.13
From 10.0.0 before 10.0.2
Fixed in 10.0.2
From 11.0.0 before 11.0.1
Fixed in 11.0.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.3.13"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<9.3.13"
}
},
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.2"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=10.0.0 <10.0.2"
}
},
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.1"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=11.0.0 <11.0.1"
}
}
],
"versions": []
}