CVE-2023-48052

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295 CWE-599

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
httpie	httpie	3.2.2

References

https://gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.mdThird Party Advisory
https://gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.mdThird Party Advisory

Timeline

Published: Nov 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-480537.5Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the di CVE-2023-480547.4Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a ma CVE-2023-480557.5SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This vulnerability can lead to the disclosure of informati CVE-2023-480567.5PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the CVE-2023-480588.8Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run CVE-2023-48065.9A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulti CVE-2023-480608.8Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add CVE-2023-480634.3An issue was discovered in dreamer_cms 4.1.3. There is a CSRF vulnerability that can delete a theme project via /admin/category/delete.CVE-2023-480685.4DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec_add.php.CVE-2023-48077.8Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applica CVE-2023-480789.8SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' para CVE-2023-48084.8The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users suc