CVE-2023-28322

Katalog CVE

CVSS 3.7 · Low EPSS 2,2%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada haxx curl, fedoraproject fedora +7 lainnya. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Rincian

Terbit di NVD

26 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hackerone.com/reports/1954658 exploit · patch · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/47 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/48 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/52 mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202310-12 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230609-0009/ advisory pihak ketiga
• https://support.apple.com/kb/HT213843 advisory pihak ketiga
• https://support.apple.com/kb/HT213844 advisory pihak ketiga
• https://support.apple.com/kb/HT213845 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULS...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24...