CVE-2022-27776
6.5
MEDIUM
CVSS 3.1
EPSS 0.68%
Description
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
How to fix CVE-2022-27776
To remediate CVE-2022-27776, upgrade the affected package to a fixed version below.
- Alpine/curl—upgrade to 7.79.1-r1 or later
- Debian/curl—upgrade to 7.74.0-1.3+deb11u2 or later
Is CVE-2022-27776 being exploited?
Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 7.79.1-r1
- from 0, < 7.74.0-1.3+deb11u2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |