Vulnerability Description
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | < 7.83.0 |
| Fedoraproject | Fedora | 36 |
| Debian | Debian Linux | 10.0 |
| Netapp | Hci Bootstrap Os | - |
| Netapp | Hci Compute Node | - |
| Netapp | Clustered Data Ontap | - |
| Netapp | Solidfire \& Hci Management Node | - |
| Netapp | Solidfire \& Hci Storage Node | - |
| Brocade | Fabric Operating System | - |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Netapp | H410S Firmware | - |
| Netapp | H410S | - |
| Splunk | Universal Forwarder | >= 8.2.0, < 8.2.12 |
Related Weaknesses (CWE)
References
- https://hackerone.com/reports/1547048ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220609-0008/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
- https://hackerone.com/reports/1547048ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202212-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220609-0008/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197Third Party Advisory
FAQ
What is CVE-2022-27776?
CVE-2022-27776 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
How severe is CVE-2022-27776?
CVE-2022-27776 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-27776?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Curl, Fedoraproject Fedora, Debian Debian Linux, Netapp Hci Bootstrap Os, Netapp Hci Compute Node.