VulnerabilityModified
CVE-2022-35252
Effectively allowing a"sister site" to deny service to all siblings.
LOW 3.7EPSS 1.95%
Does this matter?
Lower severity and a low EPSS score (1.95%). Track it; it rarely justifies an emergency change on its own.
Description
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
- CVSS 3.1
- 3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 1.95% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- haxx/curl · netapp/clustered data ontap · netapp/element software · netapp/hci management node · netapp/solidfire · netapp/bootstrap os · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410s firmware · apple/macos · debian/debian linux · splunk/universal forwarder
- Source
- support@hackerone.com
References
- http://seclists.org/fulldisclosure/2023/Jan/20Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/21Mailing List, Third Party Advisory
- https://hackerone.com/reports/1613943Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220930-0005/Third Party Advisory
- https://support.apple.com/kb/HT213603Third Party Advisory
- https://support.apple.com/kb/HT213604Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/20Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/21Mailing List, Third Party Advisory
- https://hackerone.com/reports/1613943Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220930-0005/Third Party Advisory
- https://support.apple.com/kb/HT213603Third Party Advisory
- https://support.apple.com/kb/HT213604Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.