← לוח פגיעויות

CVE-2022-27780

גבוהה 7.5

תיאור (מקור, אנגלית)

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

מדדים

CVSS 3.1
7.5 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS — סבירות ניצול
3% (אחוזון 100) נכון ל-15/10/2026
CWE
CWE-177, CWE-918

מוצרים מושפעים

haxx: curl; netapp: hci bootstrap os; netapp: hci compute node; netapp: clustered data ontap; netapp: solidfire\, enterprise sds \& hci storage node; netapp: solidfire \& hci management node; netapp: h410s firmware; netapp: h410s; netapp: h700s firmware; netapp: h700s; netapp: h500s firmware; netapp: h500s; netapp: h300s firmware; netapp: h300s; splunk: universal forwarder

קישורים