CVE-2015-3236

2015-06-2219:59:03

CWE-200

[email protected]

web.nvd.nist.gov

curl

libcurl

cve-2015-3236

http

authentication

security

remote attackers

sensitive information

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

9.1 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.0%

JSON

cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.

Affected configurations

NVD

Node

haxxcurlMatch7.40.0

haxxcurlMatch7.41.0

haxxcurlMatch7.42.0

haxxcurlMatch7.42.1

haxxlibcurlMatch7.40.0

haxxlibcurlMatch7.41.0

haxxlibcurlMatch7.42.0

haxxlibcurlMatch7.42.1

CPENameOperatorVersion
haxx:curlhaxx curleq7.40.0
haxx:curlhaxx curleq7.41.0
haxx:curlhaxx curleq7.42.0
haxx:curlhaxx curleq7.42.1
haxx:libcurlhaxx libcurleq7.40.0
haxx:libcurlhaxx libcurleq7.41.0
haxx:libcurlhaxx libcurleq7.42.0
haxx:libcurlhaxx libcurleq7.42.1

CPE	Name	Operator	Version
haxx:curl	haxx curl	eq	7.40.0
haxx:curl	haxx curl	eq	7.41.0
haxx:curl	haxx curl	eq	7.42.0
haxx:curl	haxx curl	eq	7.42.1
haxx:libcurl	haxx libcurl	eq	7.40.0
haxx:libcurl	haxx libcurl	eq	7.41.0
haxx:libcurl	haxx libcurl	eq	7.42.0
haxx:libcurl	haxx libcurl	eq	7.42.1