CVE-2023-43804

highpriority · track · 42EPSS 0.014 · 72 %ileexploit · PoCDEEUFRNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.36% (72nd) EPSS

CVSS 8.1 · high

Is it mine?

51 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-26

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.1

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 5.2

v3.18.1highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondary · security-advisories@github.comexploitability 0.7 · impact 5.2

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Psecondary · CVSS-BT (t0sche)

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · NCSC-NL NL

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200USCWE-200USCWE-200USCWE-200US

exploits (1)

Public proof-of-concept and weaponised exploit code.

deepanshu-khurana/CVE-2023-43804deepanshu-khurana/CVE-2023-43804PoC · poc_in_github

affected products (51)

Products and version ranges known to be affected.

Dell ECS <3.8.1.0all versionscert_bundDE
Dell PowerEdgeall versionscert_bundDEcpe:/h:dell:poweredge:-
IBM InfoSphere Information Serverall versionscert_bundDEcpe:/a:ibm:infosphere_information_server:-
Dell ECS< 3.8.1.0cert_bundDE
urllib3 urllib3≤ < 1.26.17enisa_euvdEU
urllib3 urllib32.0.0, → 2.0.6enisa_euvdEU
Andrey Petrov urllib3≤ 1.26.17fstec_bduRU
Andrey Petrov urllib32.0.0 → 2.0.6fstec_bduRU
Canonical Ltd. Ubuntu≤ 23.10fstec_bduRU
Canonical Ltd. Ubuntu≤ 20.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 16.04 ESMfstec_bduRU
Canonical Ltd. Ubuntu≤ 22.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 18.04 ESMfstec_bduRU
Canonical Ltd. Ubuntu≤ 23.04fstec_bduRU
Fedora Project Fedora≤ 37fstec_bduRU
Fedora Project Fedora≤ 39fstec_bduRU
Fedora Project Fedora≤ 38fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 9fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat, Inc. Red Hat OpenShift Container Platform≤ 4fstec_bduRU

showing 20 of 51

advisories (11)

Vendor and ecosystem advisories describing this.

NCSC-2025-0028Kwetsbaarheden verholpen in Oracle AnalyticsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Analytics producten, zoals Business Intelligence, Analytics Desktop en BI Publisher.
WID-SEC-W-2023-2862Red Hat Enterprise Linux: Mehrere SchwachstellenDeutsch2023-11-08csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um vertrauliche Informationen offenzulegen oder einen nicht näher spezifizierten Angriff zu starten.
WID-SEC-W-2023-2964Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-11-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Code auszuführen und um nicht näher spezifizierte Auswirkungen zu erzielen.
WID-SEC-W-2023-3025IBM InfoSphere Information Server: Mehrere SchwachstellenDeutsch2023-11-28csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial of Service Zustand herbeizuführen.
WID-SEC-W-2023-3146IBM MQ Operator and Queue manager: Mehrere SchwachstellenDeutsch2023-12-13csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM MQ Operator and Queue manager ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
WID-SEC-W-2024-0423IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2024-02-19csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.
WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
WID-SEC-W-2024-3731IBM Sterling Connect: Direct Web Service: Mehrere SchwachstellenDeutsch2024-12-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Sterling Connect: Direct Web Service ausnutzen, um Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.
GHSA-v845-jxx5-vc9f`Cookie` HTTP header isn't stripped on cross-origin redirects2023-10-02ghsa · osvUS
urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. Users **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach. ## Affected usages We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: * Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6) * Using the `Cookie` header on requests, which is mostly typical for impersonating a browser. * Not disabling HTTP redirects * Either not using HTTPS or for the origin server to redirect to a malicious origin. ## Remediation * Upgrading to at least urllib3 v1.26.17 or v2.0.6 * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Cookie` header.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
PYSEC-2023-1922023-10-04vendor · osvUS
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl certfr NVD CVE.org MITRE

published 2023-10-04modified 2026-10-08

references (39)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan