CVE-2018-18074

HIGH

python/requests < 2.20.0 - Credential Exposure via HTTPS-to-HTTP Redirect

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-18074. PoCs published by mlbrilliance.

AI-analyzed exploit summary This repository is a demo target for a supply chain security tool and intentionally includes vulnerable lockfiles for detection purposes. It does not contain exploit code or technical analysis of CVE-2018-18074.

Description

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Exploits (1)

nomisec STUB
by mlbrilliance · poc
https://github.com/mlbrilliance/aurora-demo-lockfile

This repository is a demo target for a supply chain security tool and intentionally includes vulnerable lockfiles for detection purposes. It does not contain exploit code or technical analysis of CVE-2018-18074.

Classification
Stub 100%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: requests (2.20.0)
No auth needed
Prerequisites: none
devstral-2 · analyzed May 19, 2026 Full analysis →

References (10)

Core 10
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3790-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3790-2/
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2035
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugs.debian.org/910766
Exploit, Patch, Third Party Advisory x_refsource_misc
https://github.com/requests/requests/issues/4716
Patch, Third Party Advisory x_refsource_misc
https://github.com/requests/requests/pull/4718

Scores

CVSS v3 7.5
EPSS 0.0020
EPSS Percentile 42.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-522
Status published
Products (10)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 18.10
opensuse/leap 15.1
pypi/requests 0 - 2.20.0PyPI
python/requests < 2.20.0
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_server 7.0
redhat/enterprise_linux_workstation 7.0
Published Oct 09, 2018
Tracked Since Feb 18, 2026