CVEvulnerability

CVE-2014-3613

5.0 MEDIUM Published 2014-11-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-11-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-310

Description

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.

Affected configurations

• haxx curl (<= 7.37.1) • haxx curl 7.31.0 • haxx curl 7.32.0 • haxx curl 7.33.0 • haxx curl 7.34.0 • haxx curl 7.35.0 • haxx curl 7.36.0 • haxx curl 7.37.0 • haxx libcurl (<= 7.37.1) • haxx libcurl 7.31.0 • haxx libcurl 7.32.0 • haxx libcurl 7.33.0 • haxx libcurl 7.34.0 • haxx libcurl 7.35.0 • haxx libcurl 7.36.0 • haxx libcurl 7.37.0 • apple mac os x (<= 10.10.4)

Related

Weakness · not in database (1)

References