Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-27774

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Published

2022-06-02T14:15:43.317

Last Modified

2024-11-21T06:56:09.677

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.7 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

6.8

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-522
  • Type: Primary
    CWE-522
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application haxx curl ≤ 7.82.0 Yes
Operating System debian debian_linux 10.0 Yes
Operating System debian debian_linux 11.0 Yes
Operating System netapp hci_bootstrap_os - Yes
Hardware netapp hci_compute_node - No
Application netapp clustered_data_ontap - Yes
Application netapp solidfire_\&_hci_management_node - Yes
Application netapp solidfire_\&_hci_storage_node - Yes
Operating System brocade fabric_operating_system - Yes
Operating System netapp h300s_firmware - Yes
Hardware netapp h300s - No
Operating System netapp h500s_firmware - Yes
Hardware netapp h500s - No
Operating System netapp h700s_firmware - Yes
Hardware netapp h700s - No
Operating System netapp h410s_firmware - Yes
Hardware netapp h410s - No
Application splunk universal_forwarder < 8.2.12 Yes
Application splunk universal_forwarder < 9.0.6 Yes
Application splunk universal_forwarder 9.1.0 Yes
References