CVE-2022-27774
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
- Score
- CVSS 3.1 5.7 Medium
- Status
- Modified - support@hackerone.com
- Published
- 2022-06-02
- Last modified
- 2026-10-14
- Weaknesses
- CWE-522
Affected products
- Fabric Operating System (Broadcom)
- Debian Linux (Debian)
- Curl (Haxx)
- Clustered Data Ontap (Netapp)
- H300s Firmware (Netapp)
- H410s Firmware (Netapp)
- H500s Firmware (Netapp)
- H700s Firmware (Netapp)
- Hci Bootstrap Os (Netapp)
- Solidfire & Hci Management Node (Netapp)
- Solidfire & Hci Storage Node (Netapp)
- Simatic S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)
- Simatic S7-1500 Cpu 1518f-4 Pndp Mfp (Siemens)
- Siplus S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)
- Universal Forwarder (Splunk)
References
- https://hackerone.com/reports/1543773
- https://security.netapp.com/advisory/ntap-20220609-0008/
- https://www.debian.org/security/2022/dsa-5197
- https://security.gentoo.org/glsa/202212-01
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
