CVE-2022-27776
- State
- Published
- Severity
- Not scored
- Published
- Jun 1, 2022
- Updated
- Oct 14, 2026
- Reserved
- Mar 23, 2022
Description
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
Scores
The record has no CVSS score.
Weaknesses
- CWE-522 Insufficiently Protected Credentials (CWE-522)
Affected Products
| Product | Versions |
|---|---|
https://github.com/curl/curln/a |
|
References
- https://hackerone.com/reports/1547048
- https://security.netapp.com/advisory/ntap-20220609-0008/
- DSA-5197vendor-advisory
- [debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security updatemailing-list
- FEDORA-2022-f83aec6d57vendor-advisory
- FEDORA-2022-bca2c95559vendor-advisory
- GLSA-202212-01vendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.