CVE-2014-3620

2014-11-1815:59:00

CWE-310

[email protected]

web.nvd.nist.gov

curl

libcurl

cve-2014-3620

same origin policy

remote attack

cookie setting

security vulnerability

7.1 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

77.2%

JSON

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.

CPENameOperatorVersion
haxx:curlhaxx curleq7.35.0
haxx:curlhaxx curleq7.32.0
haxx:curlhaxx curleq7.33.0
haxx:curlhaxx curleq7.36.0
haxx:curlhaxx curlle7.37.1
haxx:curlhaxx curleq7.31.0
haxx:curlhaxx curleq7.34.0
haxx:curlhaxx curleq7.37.0
haxx:libcurlhaxx libcurleq7.37.0
haxx:libcurlhaxx libcurleq7.33.0

CPE	Name	Operator	Version
haxx:curl	haxx curl	eq	7.35.0
haxx:curl	haxx curl	eq	7.32.0
haxx:curl	haxx curl	eq	7.33.0
haxx:curl	haxx curl	eq	7.36.0
haxx:curl	haxx curl	le	7.37.1
haxx:curl	haxx curl	eq	7.31.0
haxx:curl	haxx curl	eq	7.34.0
haxx:curl	haxx curl	eq	7.37.0
haxx:libcurl	haxx libcurl	eq	7.37.0
haxx:libcurl	haxx libcurl	eq	7.33.0