Vulnerability Description
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | >= 4.9, <= 7.82.0 |
| Debian | Debian Linux | 10.0 |
| Netapp | Hci Bootstrap Os | - |
| Netapp | Hci Compute Node | - |
| Netapp | Clustered Data Ontap | - |
| Netapp | Solidfire \& Hci Management Node | - |
| Netapp | Solidfire \& Hci Storage Node | - |
| Brocade | Fabric Operating System | - |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Netapp | H410S Firmware | - |
| Netapp | H410S | - |
| Splunk | Universal Forwarder | >= 8.2.0, < 8.2.12 |
Related Weaknesses (CWE)
References
- https://hackerone.com/reports/1543773ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220609-0008/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
- https://hackerone.com/reports/1543773ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220609-0008/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
FAQ
What is CVE-2022-27774?
CVE-2022-27774 is a vulnerability with a CVSS score of 5.7 (MEDIUM). An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is u...
How severe is CVE-2022-27774?
CVE-2022-27774 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-27774?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Curl, Debian Debian Linux, Netapp Hci Bootstrap Os, Netapp Hci Compute Node, Netapp Clustered Data Ontap.