CVE-2022-27780

🗓️ 01 Jun 2022 00:00:00Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 445 Views🌐 WEB

CVE-2022-27780: Incorrect curl URL parser allows bypassing filter

Reporter	Title	Published	Views	Family All 86
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	23 Sep 202222:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libcURL affect IBM Rational ClearCase ( CVE-2022-27778, CVE-2022-27779, CVE-2022-27780, CVE-2022-27782, CVE-2022-30115, CVE-2022-27774 )	25 Jul 202214:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent and Base Module use libcurl with multiple known vulnerabilities	6 Oct 202204:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115)	25 Aug 202215:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
FreeBSD	curl -- Multiple vulnerabilities	11 May 202200:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 10 package curl version 7.83.1-alt1	19 May 202200:00	–	altlinux
attackerkb	CVE-2022-27780	2 Jun 202214:15	–	attackerkb
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-206)	4 Nov 202200:00	–	nessus

NVD

Vulners

Vulnrichment

Node

haxx curlRange7.80.0–7.83.1

Node

AND

netapp hci_bootstrap_osMatch-

netapp hci_compute_nodeMatch-

Node

netapp clustered_data_ontapMatch-

netapp solidfire,_enterprise_sds_&_hci_storage_nodeMatch-

netapp solidfire_&_hci_management_nodeMatch-

Node

AND

netapp h410s_firmwareMatch-

netapp h410sMatch-

Node

AND

netapp h700s_firmwareMatch-

netapp h700sMatch-

Node

AND

netapp h500s_firmwareMatch-

netapp h500sMatch-

Node

AND

netapp h300s_firmwareMatch-

netapp h300sMatch-

Node

splunk universal_forwarderRange8.2.0–8.2.12

splunk universal_forwarderRange9.0.0–9.0.6

splunk universal_forwarderMatch9.1.0

[
  {
    "vendor": "n/a",
    "product": "https://github.com/curl/curl",
    "versions": [
      {
        "version": "Fixed in 7.83.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
security	www.security.netapp.com/advisory/ntap-20220609-0009/
security	www.security.gentoo.org/glsa/202212-01
hackerone	www.hackerone.com/reports/1553841
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-398330.html

Parameter	Position	Path	Description	CWE
host	path	http://example.com%2F127.0.0.1/	The curl URL parser wrongly accepts percent-encoded URL separators like %2F when decoding the host name part of a URL, allowing for host name transposition and filter circumvention.	CWE-177, CWE-918

14 Oct 2026 17:17Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 3.15.3 - 7.5

EPSS0.02524

SSVC