What’s Vulnerable › Vulnerabilities
CVE-2022-27776
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-06-02 · updated 2026-10-14
- Weakness: CWE-522
Description
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
Affected products
- Brocade Fabric OS: all versions
- Debian Linux: 10.0, 11.0
- Fedoraproject Fedora: 36, 37
- curl: before 7.83.0 — fixed in 7.83.0
- Clustered Data ONTAP: all versions
- NetApp H300S Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Hci Bootstrap Os: all versions
- NetApp Solidfire & Hci Management Node: all versions
- NetApp Solidfire & Hci Storage Node: all versions
- Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6
How to fix
Upgrade to a fixed version: curl 7.83.0; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.
References
- https://hackerone.com/reports/1547048
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20220609-0008/
- https://www.debian.org/security/2022/dsa-5197
- https://hackerone.com/reports/1547048
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/
- https://security.gentoo.org/glsa/202212-01
Get alerted when CVE-2022-27776 or the next vulnerability affects your stack