| Vulnerability Name: | CVE-2023-28322 (CCN-255626) | ||||||||||||
| Assigned: | 2023-05-17 | ||||||||||||
| Published: | 2023-05-17 | ||||||||||||
| Updated: | 2023-08-02 | ||||||||||||
| Summary: | cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.. By sending a specially crafted request, an attacker could exploit this vulnerability to cause application to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. | ||||||||||||
| CVSS v3 Severity: | 3.7 Low (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) 3.2 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
3.2 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
| ||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2023-28322 Source: support@hackerone.com Type: Mailing List support@hackerone.com Source: support@hackerone.com Type: Mailing List support@hackerone.com Source: support@hackerone.com Type: Mailing List support@hackerone.com Source: CCN Type: Project curl Security Advisory, May 17 2023 CVE-2023-28322 more POST-after-PUT confusion Source: XF Type: UNKNOWN curl-cve202328322-sec-bypass(255626) Source: support@hackerone.com Type: Exploit, Patch, Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Mailing List, Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Mailing List, Third Party Advisory support@hackerone.com Source: CCN Type: oss-sec Mailing List, Wed, 17 May 2023 08:41:12 +0200 (CEST) curl: CVE-2023-28322: more POST-after-PUT confusion Source: support@hackerone.com Type: Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Third Party Advisory support@hackerone.com Source: support@hackerone.com Type: Third Party Advisory support@hackerone.com | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||