Vulnerability Details : CVE-2022-27779

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
Publish Date : 2022-06-02 Last Update Date : 2023-01-05

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	5.0
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	None (There is no impact to the integrity of the system)
Availability Impact	None (There is no impact to the availability of the system.)
Access Complexity	Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)
CWE ID	668

- Products Affected By CVE-2022-27779

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	Haxx	Curl	*	*	*	*	Version Details Vulnerabilities
2	Application	Netapp	Clustered Data Ontap	-	*	*	*	Version Details Vulnerabilities
3	Hardware	Netapp	Hci Compute Node	-	*	*	*	Version Details Vulnerabilities
4	Application	Netapp	Solidfire \& Hci Management Node	-	*	*	*	Version Details Vulnerabilities
5	Application	Netapp	Solidfire\, Enterprise Sds \& Hci Storage Node	-	*	*	*	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Haxx	Curl	1
Netapp	Clustered Data Ontap	1
Netapp	Hci Compute Node	1
Netapp	Solidfire \& Hci Management Node	1
Netapp	Solidfire\, Enterprise Sds \& Hci Storage Node	1

- References For CVE-2022-27779

https://hackerone.com/reports/1553301

https://security.netapp.com/advisory/ntap-20220609-0009/ CONFIRM

https://security.gentoo.org/glsa/202212-01
GENTOO GLSA-202212-01

- Vulnerability Conditions

Vulnerability is valid if product versions listed below are used 0
Netapp Solidfire\, Enterprise Sds \& Hci Storage Node * * * Netapp Hci Compute Node * * * Netapp Solidfire \& Hci Management Node * * * Netapp Clustered Data Ontap * * * Haxx Curl * * * *	Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * * Netapp Hci Bootstrap Os * * *
Vulnerability is valid if product versions listed below are used 0
Netapp Solidfire\, Enterprise Sds \& Hci Storage Node * * * Netapp Hci Compute Node * * * Netapp Solidfire \& Hci Management Node * * * Netapp Clustered Data Ontap * * * Haxx Curl * * * *	Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * * Netapp Hci Bootstrap Os * * *
Vulnerability is valid if product versions listed below are used 0
Netapp Solidfire\, Enterprise Sds \& Hci Storage Node * * * Netapp Hci Compute Node * * * Netapp Solidfire \& Hci Management Node * * * Netapp Clustered Data Ontap * * * Haxx Curl * * * *	Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * * Netapp Hci Bootstrap Os * * *
Vulnerability is valid if product versions listed below are used 0
Netapp Solidfire\, Enterprise Sds \& Hci Storage Node * * * Netapp Hci Compute Node * * * Netapp Solidfire \& Hci Management Node * * * Netapp Clustered Data Ontap * * * Haxx Curl * * * *	Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * * Netapp Hci Bootstrap Os * * *
Vulnerability is valid if product versions listed below are used 0
Netapp Solidfire\, Enterprise Sds \& Hci Storage Node * * * Netapp Hci Compute Node * * * Netapp Solidfire \& Hci Management Node * * * Netapp Clustered Data Ontap * * * Haxx Curl * * * *	Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * * Netapp Hci Bootstrap Os * * *
Vulnerability is valid if product versions listed below are used 0
Netapp Solidfire\, Enterprise Sds \& Hci Storage Node * * * Netapp Hci Compute Node * * * Netapp Solidfire \& Hci Management Node * * * Netapp Clustered Data Ontap * * * Haxx Curl * * * *	Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * * Netapp Hci Bootstrap Os * * *
Vulnerability is valid if product versions listed below are used 0
Netapp Solidfire\, Enterprise Sds \& Hci Storage Node * * * Netapp Hci Compute Node * * * Netapp Solidfire \& Hci Management Node * * * Netapp Clustered Data Ontap * * * Haxx Curl * * * *	Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * * Netapp Hci Bootstrap Os * * *

- Metasploit Modules Related To CVE-2022-27779

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)