Yüksek CVSS 7.5 PoC var
CVE-2022-27780: Curl: güvenlik açığı
Açıklama (NVD)
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
Özet bilgiler
- Ürün
- Haxx Curl
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- %2,52 (yüzdelik 85)
- CWE
- CWE-177
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| haxx-curl | 7.80.0 | — | 7.83.1 |
| netapp-hci-bootstrap-os | — | — | — |
| netapp-clustered-data-ontap | — | — | — |
| netapp-solidfire-enterprise-sds-hci-storage-node | — | — | — |
| netapp-solidfire-hci-management-node | — | — | — |
| netapp-h410s-firmware | — | — | — |
| netapp-h700s-firmware | — | — | — |
| netapp-h500s-firmware | — | — | — |
| netapp-h300s-firmware | — | — | — |
| splunk-universal-forwarder | 8.2.0 | — | 8.2.12 |
| splunk-universal-forwarder | 9.0.0 | — | 9.0.6 |
| splunk-universal-forwarder | 9.1.0 | 9.1.0 | — |