CVE-2022-32221

Katalog CVE

CVSS 9.8 · Critical EPSS 4,7%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada haxx curl, netapp clustered data ontap +7 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

Rincian

Terbit di NVD

5 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

4,7% peluang dieksploitasi; lebih tinggi dari 91,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://seclists.org/fulldisclosure/2023/Jan/19 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jan/20 mailing list · advisory pihak ketiga
• https://hackerone.com/reports/1704017 exploit · issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202212-01 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230110-0006/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230208-0002/ advisory pihak ketiga
• https://support.apple.com/kb/HT213604 advisory pihak ketiga
• https://support.apple.com/kb/HT213605 advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5330 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/05/17/4 mailing list