CVE-2025-14524

Katalog CVE

CVSS 5.3 · Medium EPSS 0,68%

Kerentanan Insufficiently Protected Credentials pada haxx curl. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Rincian

Terbit di NVD

8 Januari 2026

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2025-14524.html patch · advisory vendor
• https://curl.se/docs/CVE-2025-14524.json advisory vendor
• http://www.openwall.com/lists/oss-security/2026/01/07/4 mailing list · patch · advisory pihak ketiga
• https://hackerone.com/reports/3459417 exploit · issue tracking · advisory pihak ketiga