libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
References
| Link | Resource |
|---|---|
| https://hackerone.com/reports/1553301 | Exploit Third Party Advisory |
| https://security.gentoo.org/glsa/202212-01 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220609-0009/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
|
History
27 Mar 2024, 15:02
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |
|
| First Time |
Splunk
Splunk universal Forwarder |
18 Jul 2023, 13:55
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
05 Jan 2023, 17:58
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netapp h500s
Netapp h700s Netapp solidfire \& Hci Management Node Netapp h410s Netapp solidfire\, Enterprise Sds \& Hci Storage Node Netapp hci Compute Node Netapp clustered Data Ontap Netapp h300s Netapp hci Bootstrap Os Netapp h410s Firmware Netapp h700s Firmware Netapp Netapp h300s Firmware Netapp h500s Firmware |
|
| CPE | cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
|
| References | (GENTOO) https://security.gentoo.org/glsa/202212-01 - Third Party Advisory |
19 Dec 2022, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jun 2022, 17:57
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220609-0009/ - Third Party Advisory | |
| References | (MISC) https://hackerone.com/reports/1553301 - Exploit, Third Party Advisory | |
| CWE | CWE-668 | |
| First Time |
Haxx curl
Haxx |
|
| CPE | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
09 Jun 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Jun 2022, 14:53
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-02 14:15
Updated : 2024-03-27 15:02
NVD link : CVE-2022-27779
Mitre link : CVE-2022-27779
CVE.ORG link : CVE-2022-27779
JSON object : View
Products Affected
netapp
- h700s_firmware
- h700s
- h300s_firmware
- h410s
- h500s_firmware
- hci_compute_node
- h410s_firmware
- solidfire_\&_hci_management_node
- solidfire\,_enterprise_sds_\&_hci_storage_node
- hci_bootstrap_os
- h500s
- clustered_data_ontap
- h300s
splunk
- universal_forwarder
haxx
- curl
CWE