CVE-2025-14840
CVE-2025-14840 · HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1.
CVSS 7.5 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
http client manager
- Versions
- ≥ 0.0.0, < 9.3.13: Affected (semver)
- ≥ 10.0.0, < 10.0.2: Affected (semver)
- ≥ 11.0.0, < 11.0.1: Affected (semver)
Update to 10.0.2; Update to 11.0.1; Update to 9.3.13
drupal/http_client_manager Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 9.3.13
- ECOSYSTEM: ≥ 10.0.0, < 10.0.2
- ECOSYSTEM: ≥ 11.0.0, < 11.0.1
Update to 9.3.13; Update to 10.0.2; Update to 11.0.1