CVE-2022-27780

2022-06-0100:00:00

CWE-177

hackerone

www.cve.org

cve-2022-27780

curl url parser

percent-encoded url separators

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

43.3%

JSON

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get transposed into http://example.com/127.0.0.1/. This flawcan be used to circumvent filters, checks and more.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/curl/curl",
    "versions": [
      {
        "version": "Fixed in 7.83.1",
        "status": "affected"
      }
    ]
  }
]