When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
Cuando curl es usado para recuperar y analizar las cookies de un servidor HTTP(S), acepta las cookies usando códigos de control que cuando son enviados de vuelta a un servidor HTTP podrían hacer que el servidor devolviera respuestas 400. En efecto, permite que un "sitio hermano" deniegue el servicio a todos los hermanos.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | LOW |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-20
|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd2d39fe400> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7fd369eea0c0> | Application |
| netapp | element_software | - | <built-in method update of dict object at 0x7fd36ad4c0c0> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd2a1f91a00> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd369ee82c0> | Application |
| netapp | bootstrap_os | - | <built-in method update of dict object at 0x7fd369ee9c80> | Operating System |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd3697d5cc0> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd369eea5c0> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd3697d6d40> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd369eebf00> | Operating System |
| apple | macos | * | <built-in method update of dict object at 0x7fd3697d7240> | Operating System |
| apple | macos | * | <built-in method update of dict object at 0x7fd369eeb540> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd34122c700> | Operating System |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd36a7ed540> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd3697d7740> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd3697d6a40> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |