Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Network
0

CVE-2022-32205

Disclosure Date: July 07, 2022 •
CVE-2022-32205 CVSS v3 Base Score: 4.3
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven’t expired. Due to cookie matching rules, a server on foo.example.com can set cookies that also would match for bar.example.com, making it it possible for a “sister server” to effectively cause a denial of service for a sibling site on the same second level domain using this method.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
4.3 Medium
Impact Score:
1.4
Exploitability Score:
2.8
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
Low

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
https://github.com/curl/curl Fixed in 7.84.0
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • apple,
  • debian,
  • fedoraproject,
  • haxx,
  • netapp,
  • siemens,
  • splunk

Products

  • clustered data ontap -,
  • curl,
  • debian linux 11.0,
  • element software -,
  • fedora 35,
  • h300s firmware -,
  • h410s firmware -,
  • h500s firmware -,
  • h700s firmware -,
  • hci management node -,
  • macos,
  • scalance sc622-2c firmware,
  • scalance sc626-2c firmware,
  • scalance sc632-2c firmware,
  • scalance sc636-2c firmware,
  • scalance sc642-2c firmware,
  • scalance sc646-2c firmware,
  • solidfire -,
  • universal forwarder,
  • universal forwarder 9.1.0
Technical Analysis