HIGH✓ PATCH🇬🇧 English

CVE-2022-27780

CVSS 7.5v3.1pub. 2022-06-02upd. 2024-11-21

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Haxx Curl
APP
Haxx
7.80.0 – 7.83.1 (bez)
Netapp Clustered Data Ontap
APP
Netapp
wszystkie wersje
Netapp H300s
HW
Netapp
wszystkie wersje
Netapp H300s Firmware
OS
Netapp
wszystkie wersje
Netapp H410s
HW
Netapp
wszystkie wersje
Netapp H410s Firmware
OS
Netapp
wszystkie wersje
Netapp H500s
HW
Netapp
wszystkie wersje
Netapp H500s Firmware
OS
Netapp
wszystkie wersje
Netapp H700s
HW
Netapp
wszystkie wersje
Netapp H700s Firmware
OS
Netapp
wszystkie wersje
Netapp Hci Bootstrap Os
OS
Netapp
wszystkie wersje
Netapp Hci Compute Node
HW
Netapp
wszystkie wersje
Netapp Solidfire\, Enterprise Sds \& Hci Storage Node
APP
Netapp
wszystkie wersje
Netapp Solidfire \& Hci Management Node
APP
Netapp
wszystkie wersje
Splunk Universal Forwarder
APP
Splunk
9.1.08.2.0 – 8.2.12 (bez)9.0.0 – 9.0.6 (bez)