1. CVE-Search
  2. CVE-2022-27779
ID CVE-2022-27779
Summary libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
References
Vulnerable Configurations
  • cpe:2.3:a:haxx:curl:7.82.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.82.0:*:*:*:*:*:*:*
  • cpe:2.3:a:haxx:curl:7.83.0:*:*:*:*:*:*:*
    cpe:2.3:a:haxx:curl:7.83.0:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
    cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
    cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
    cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
    cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:9.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.10:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:8.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:splunk:universal_forwarder:8.2.11:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 27-03-2024 - 15:02)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
Last major update 27-03-2024 - 15:02
Published 02-06-2022 - 14:15
Last modified 27-03-2024 - 15:02
Back to Top