Уязвимость раскрытия недостаточно защищённых учетных данных в curl при использовании HTTP(S) перенаправлений
Описание
Уязвимость недостаточно защищённых учетных данных, присутствующая в curl, способна привести к утечке учетных данных. Это происходит, когда используются HTTP(S) перенаправления с аутентификацией. Данные могут быть раскрыты другим сервисам, работающим на различных протоколах или портах.
Затронутые версии ПО
- curl версии с 4.9 по 7.82.0 включительно
Тип уязвимости
Утечка учетных данных
Ссылки
- ExploitThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одновременно
Одно из
Одновременно
Одновременно
Одновременно
Одновременно
Одно из
EPSS
5.7 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
Связанные уязвимости
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
An insufficiently protected credentials vulnerability exists in curl 4 ...
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
EPSS
5.7 Medium
CVSS3
3.5 Low
CVSS2