5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
0.002 Low
EPSS
Percentile
58.8%
The cURL command-line utility vulnerability is related to the -no-clobber toolkit, which is used
in conjunction with --remove-on-error. Exploitation of the vulnerability could allow an attacker acting remotely,
trick the victim into connecting to a malicious server and forcing the command-line tool to
delete unexpected files
The vulnerability in the cURL command-line tool is related to the fact that libcurl erroneously allows the installation of
HTTP cookies for top-level domains (TLDs) if the hostname is prepended with a terminating dot.
Exploitation of the vulnerability could allow an attacker acting remotely to create cookies,
that are subsequently sent to a different and unrelated site or domain
The cURL command line utility vulnerability is related to the fact that the curl URL parser
incorrectly accepts percentage-encoded URL delimiters, such as “/”, when decoding a portion of a hostname.
decoding the hostname portion of a URL, turning it into another URL that uses the
incorrect hostname when it is later retrieved. Exploitation of the vulnerability could allow an attacker,
acting remotely, to bypass various internal filters and checks and force curl to connect to the wrong web application.
the wrong web application
The cURL command-line utility vulnerability is related to a bug in the HSTS implementation that could allow
curl to continue using the HTTP protocol instead of HTTPS if the hostname in the specified URL
used an endpoint but did not use it when building the HSTS cache. Exploitation of the vulnerability
could allow an attacker acting remotely to intercept traffic and obtain potentially
sensitive information
A vulnerability in the cURL command line utility is related to an infinite loop when processing requests with the
CURLOPT_CERTINFO parameter. Exploitation of the vulnerability could allow an attacker acting remotely,
consume all available system resources and cause denial of service conditions
The cURL command line utility vulnerability is related to how libcurl handles previously used connections in the connection pool for subsequent transfers.
connections in the connection pool for subsequent transfers. Exploitation of the vulnerability could allow
an attacker acting remotely to send an authentication string from one resource to another,
exposing credentials to a third party
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
0.002 Low
EPSS
Percentile
58.8%