CVE Vulnerabilities

CVE-2022-27774

Insufficiently Protected Credentials

Published: Jun 02, 2022 | Modified: Mar 27, 2024
CVSS 3.x
5.7
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS 2.x
3.5 LOW
AV:N/AC:M/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
5 MODERATE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Ubuntu
MEDIUM

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Weakness

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Software

Name Vendor Start Version End Version
Curl Haxx 4.9 (including) 7.82.0 (including)
Curl Ubuntu bionic *
Curl Ubuntu devel *
Curl Ubuntu esm-infra/bionic *
Curl Ubuntu esm-infra/xenial *
Curl Ubuntu focal *
Curl Ubuntu impish *
Curl Ubuntu jammy *
Curl Ubuntu trusty/esm *
Curl Ubuntu upstream *
Red Hat Enterprise Linux 8 RedHat curl-0:7.61.1-22.el8_6.3 *
Red Hat Enterprise Linux 9 RedHat curl-0:7.76.1-14.el9_0.4 *
Red Hat Enterprise Linux 9 RedHat curl-0:7.76.1-14.el9_0.4 *

Potential Mitigations

References