CVEvulnerability

CVE-2014-3620

5.0 MEDIUM Published 2014-11-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-11-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-310

Description

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.

Affected configurations

• haxx curl (<= 7.37.1) • haxx curl 7.31.0 • haxx curl 7.32.0 • haxx curl 7.33.0 • haxx curl 7.34.0 • haxx curl 7.35.0 • haxx curl 7.36.0 • haxx curl 7.37.0 • haxx libcurl (<= 7.37.1) • haxx libcurl 7.31.0 • haxx libcurl 7.32.0 • haxx libcurl 7.33.0 • haxx libcurl 7.34.0 • haxx libcurl 7.35.0 • haxx libcurl 7.36.0 • haxx libcurl 7.37.0 • apple mac os x (<= 10.10.4)

Related

Weakness · not in database (1)

References