CVE-2015-3236

2015-06-2219:59:00

CWE-200

[email protected]

web.nvd.nist.gov

curl

libcurl

cve-2015-3236

http

authentication

security

remote attackers

sensitive information

9 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.005 Low

EPSS

Percentile

75.6%

JSON

cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.

CPENameOperatorVersion
haxx:curlhaxx curleq7.40.0
haxx:libcurlhaxx libcurleq7.40.0
haxx:curlhaxx curleq7.42.0
haxx:libcurlhaxx libcurleq7.42.1
haxx:libcurlhaxx libcurleq7.41.0
haxx:curlhaxx curleq7.42.1
haxx:curlhaxx curleq7.41.0
haxx:libcurlhaxx libcurleq7.42.0

CPE	Name	Operator	Version
haxx:curl	haxx curl	eq	7.40.0
haxx:libcurl	haxx libcurl	eq	7.40.0
haxx:curl	haxx curl	eq	7.42.0
haxx:libcurl	haxx libcurl	eq	7.42.1
haxx:libcurl	haxx libcurl	eq	7.41.0
haxx:curl	haxx curl	eq	7.42.1
haxx:curl	haxx curl	eq	7.41.0
haxx:libcurl	haxx libcurl	eq	7.42.0