CVE-2022-35406: 
Burp Suite vulnerability analysis and mitigation

A URL disclosure vulnerability (CVE-2022-35406) was discovered in Burp Suite versions prior to 2022.6. The vulnerability was identified on July 8, 2022, affecting both Professional and Community editions of the software. The issue occurs when users view crafted responses in the Repeater or Intruder components of Burp Suite, where the application may incorrectly interpret these responses as redirects (NIST, MITRE).

The vulnerability stems from an incorrect interpretation of crafted responses as redirects within Burp Suite's Repeater and Intruder components. This misinterpretation could lead to unintended URL disclosures. The issue is classified as a low-severity security vulnerability that affects the response handling mechanism of the application (PortSwigger).

The vulnerability could result in the disclosure of URLs when viewing specially crafted responses in the Repeater or Intruder components. While classified as low-severity, this could potentially lead to information disclosure that wasn't intended to be revealed (PortSwigger).

The vulnerability requires a user to view a crafted response in either the Repeater or Intruder components of Burp Suite. The issue was discovered by security researcher Vrushabh Doshi (PortSwigger).

The vulnerability was patched in Burp Suite version 2022.6. Users are advised to upgrade to this version or later to resolve the security issue. The fix includes improvements to how Burp Suite handles response interpretation in the Repeater and Intruder components (PortSwigger).