Vulnerability Description
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | >= 7.0.0, <= 7.881 |
| Fedoraproject | Fedora | 36 |
| Netapp | Active Iq Unified Manager | - |
| Netapp | Clustered Data Ontap | 9.0 |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Netapp | H410S Firmware | - |
| Netapp | H410S | - |
| Splunk | Universal Forwarder | >= 8.2.0, < 8.2.12 |
Related Weaknesses (CWE)
References
- https://hackerone.com/reports/1891474ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/04/msg00025.htmlMailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230420-0011/Third Party Advisory
- https://hackerone.com/reports/1891474ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/04/msg00025.htmlMailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202310-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230420-0011/Third Party Advisory
FAQ
What is CVE-2023-27533?
CVE-2023-27533 is a vulnerability with a CVSS score of 8.8 (HIGH). A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server...
How severe is CVE-2023-27533?
CVE-2023-27533 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-27533?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Curl, Fedoraproject Fedora, Netapp Active Iq Unified Manager, Netapp Clustered Data Ontap, Netapp H300S Firmware.