Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2023-28322

Low
3.7/10

Summary

An information disclosure vulnerability exists in curl 7.7 through 8.0.1 when doing HTTP(S) transfers, libcurl might erroneously use the read callback ("CURLOPT_READFUNCTION") to ask for data to send, even when the "CURLOPT_POSTFIELDS" option has been set if the same handle previously was used to issue a "PUT" request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published