CVE-2023-23914

Katalog CVE

CVSS 9.1 · Critical EPSS 0,86%

Kerentanan Cleartext Transmission of Sensitive Information pada haxx curl, netapp active iq unified manager +6 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

Rincian

Terbit di NVD

23 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.gentoo.org/glsa/202310-12 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230309-0006/ advisory pihak ketiga
• https://hackerone.com/reports/1813864 exploit · issue tracking