CVE-2022-27774: curl from 4.9 (inclusive), through 7.82.0 (inclusive); +12 more affected products

Affected technology

curl · from 4.9 (inclusive), through 7.82.0 (inclusive)
haxx

debian linux · 10.0
debian

debian linux · 11.0
debian

hci bootstrap os · Version not applicable in the source CPE
netapp

clustered data ontap · Version not applicable in the source CPE
netapp

solidfire & hci management node · Version not applicable in the source CPE
netapp

solidfire & hci storage node · Version not applicable in the source CPE
netapp

fabric operating system · Version not applicable in the source CPE
broadcom

h300s firmware · Version not applicable in the source CPE
netapp

h500s firmware · Version not applicable in the source CPE
netapp

h700s firmware · Version not applicable in the source CPE
netapp

h410s firmware · Version not applicable in the source CPE
netapp

universal forwarder · from 8.2.0 (inclusive), before 8.2.12 (exclusive)
splunk

universal forwarder · from 9.0.0 (inclusive), before 9.0.6 (exclusive)
splunk

universal forwarder · 9.1.0
splunk

https://github.com/curl/curl · curl 4.9 to and include curl 7.82.0 are affected
Vendor not specified by the source

Description’s affected range: 4.9 to and include curl 7.82.0 are affected that could

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An attacker could extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers. NVD’s CVSS 3.1 assessment (base score 5.7/10) rates confidentiality impact as high; integrity and availability impact as none. Source advisory’s CVSS 3.1 assessment (base score 5.7/10) rates confidentiality impact as high; integrity and availability impact as none.