CVE-2022-27774

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Weakness

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Software

Name	Vendor	Start Version	End Version
Curl	Haxx	4.9 (including)	7.82.0 (including)
Red Hat Enterprise Linux 8	RedHat	curl-0:7.61.1-22.el8_6.3	*
Red Hat Enterprise Linux 9	RedHat	curl-0:7.76.1-14.el9_0.4	*
Red Hat Enterprise Linux 9	RedHat	curl-0:7.76.1-14.el9_0.4	*
Curl	Ubuntu	bionic	*
Curl	Ubuntu	devel	*
Curl	Ubuntu	esm-infra-legacy/trusty	*
Curl	Ubuntu	esm-infra/bionic	*
Curl	Ubuntu	esm-infra/focal	*
Curl	Ubuntu	esm-infra/xenial	*
Curl	Ubuntu	focal	*
Curl	Ubuntu	impish	*
Curl	Ubuntu	jammy	*
Curl	Ubuntu	trusty/esm	*
Curl	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2022-27774
CWE	https://cwe.mitre.org/data/definitions/522.html

Insufficiently Protected Credentials

Weakness

Affected Software

Potential Mitigations

References

CVE-2022-27774

Insufficiently Protected Credentials

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References