CVE-2022-27774

תיאור (מקור, אנגלית)

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

מדדים

CVSS 3.1

5.7 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS — סבירות ניצול

2% (אחוזון 100) נכון ל-15/10/2026

CWE

CWE-522

מוצרים מושפעים

haxx: curl; debian: debian linux; netapp: hci bootstrap os; netapp: hci compute node; netapp: clustered data ontap; netapp: solidfire \& hci management node; netapp: solidfire \& hci storage node; broadcom: fabric operating system; netapp: h300s firmware; netapp: h300s; netapp: h500s firmware; netapp: h500s; netapp: h700s firmware; netapp: h700s; netapp: h410s firmware

קישורים

• https://hackerone.com/reports/1543773 ExploitThird Party Advisory
• https://hackerone.com/reports/1543773 ExploitThird Party Advisory
• https://hackerone.com/reports/1543773 ExploitThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html Mailing ListThird Party Advisory
• https://security.gentoo.org/glsa/202212-01 Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220609-0008/ Third Party Advisory
• https://www.debian.org/security/2022/dsa-5197 Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html Mailing ListThird Party Advisory
• https://security.gentoo.org/glsa/202212-01 Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220609-0008/ Third Party Advisory