CVEvulnerability

CVE-2022-27774

5.7 MEDIUM Published 2022-06-02 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2022-06-02
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:P/I:N/A:N
Weaknesses
CWE-522

Description

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Affected configurations

• haxx curl (>= 4.9 <= 7.82.0) • debian debian linux 10.0 • debian debian linux 11.0 • netapp hci bootstrap os • netapp clustered data ontap • netapp solidfire \& hci management node • netapp solidfire \& hci storage node • broadcom fabric operating system • netapp h300s firmware • netapp h500s firmware • netapp h700s firmware • netapp h410s firmware • splunk universal forwarder (>= 8.2.0 < 8.2.12) • splunk universal forwarder (>= 9.0.0 < 9.0.6) • splunk universal forwarder 9.1.0

Related

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References