- Home
- CVEs with nessus.description==curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.(CVE-2016-8624)
Impact
When a domain nameends with a number sign (#), cURL does not parse the authority component of the URL correctly and can be tricked into connecting to a different host. For example :
http://f5.com#@example.com/x.txt
To exploit this vulnerability, cURL must parse a malformed URL. The BIG-IP system uses cURL/libcurl for IMAP, FTP, POP3, SMTP, Windows WMI, RealServer, and custom external monitors that incorporate cURL.
On the BIG-IP system, access to the cURL utility is restricted to locally authenticated users.
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top