CVE-2022-27774
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to…
Does this matter?
Lower severity and a low EPSS score (1.76%). Track it; it rarely justifies an emergency change on its own.
Description
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
- CVSS 3.1
- 5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 1.76% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-522
- Affected
- haxx/curl · debian/debian linux · netapp/hci bootstrap os · netapp/clustered data ontap · netapp/solidfire \& hci management node · netapp/solidfire \& hci storage node · brocade/fabric operating system · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410s firmware · splunk/universal forwarder
- Source
- support@hackerone.com
References
- https://hackerone.com/reports/1543773Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220609-0008/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
- https://hackerone.com/reports/1543773Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220609-0008/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
- https://hackerone.com/reports/1543773Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.