CVE-2023-38546

🗓️ 18 Oct 2023 03:51:31Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 879 Views🌐 WEB

This flaw in libcurl allows an attacker to insert cookies into a running program if specific conditions are met

Reporter	Title	Published	Views	Family All 300
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a heap-based buffer overflow due to libcurl and cURL. (CVE-2023-38546, CVE-2023-38545)	20 Nov 202315:27	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with GNU glibc & libcURL affect IBM Cloud Object Storage Systems (Nov2023v1)	14 Nov 202322:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, AngularJS, Golang Go, libcURL, PostgreSQL, Linux kernel might affect IBM Spectrum Protect Plus	24 Sep 202405:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to protobuf-go, libcurl, libexpat, Java SE, IBM GSKit-Crypto, open redirect, buffer overflow condition and golang-fips/openssl vulnerabilities.	30 Apr 202407:19	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of curl, IBM CICS TX Advanced is vulnerable to security restrictions potentially being bypassed (CVE-2023-38546).	13 Feb 202416:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in cURL libcurl affect AIX	11 Dec 202320:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libcurl, cURL and Linux Kernel might affect IBM Storage Copy Data Management	14 Jun 202416:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities	15 Apr 202502:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty, OpenSSL, libcurl, and IBM Java may affect IBM Storage Protect for Virtual Environments: Data Protection for Microsoft Hyper-V	15 Apr 202502:18	–	ibm

NVD

Vulners

Vulnrichment

Node

haxx libcurlRange7.9.1–8.4.0

[
  {
    "vendor": "curl",
    "product": "curl",
    "versions": [
      {
        "version": "8.4.0",
        "status": "affected",
        "lessThan": "8.4.0",
        "versionType": "semver"
      },
      {
        "version": "7.9.1",
        "status": "unaffected",
        "lessThan": "7.9.1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
support	www.support.apple.com/kb/HT214063
support	www.support.apple.com/kb/HT214036
support	www.support.apple.com/kb/HT214058
seclists	www.seclists.org/fulldisclosure/2024/Jan/34
seclists	www.seclists.org/fulldisclosure/2024/Jan/37
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/
seclists	www.seclists.org/fulldisclosure/2024/Jan/38
curl	www.curl.se/docs/CVE-2023-38546.html
forum	www.forum.vmssoftware.com/viewtopic.php
support	www.support.apple.com/kb/HT214057

Parameter	Position	Path	Description
cookie_enable_state	nested	/libcurl/c/curl_easy_duphandle.html	Vulnerability in libcurl where duplicating a transfer handle clones the cookie-enable state without cloning cookies, potentially causing the duplicated handle to load cookies from a file named 'none' if such a file exists in the program's current directory.
cookie_file	nested	/libcurl/c/curl_easy_duphandle.html	Vulnerability in libcurl where duplicating a transfer handle clones the cookie-enable state without cloning cookies, potentially causing the duplicated handle to load cookies from a file named 'none' if such a file exists in the program's current directory.
cookies_enabled	nested	/libcurl/c/curl_easy_duphandle.html	Vulnerability in libcurl where duplicating a transfer handle clones the cookie-enable state without cloning cookies, potentially causing the duplicated handle to load cookies from a file named 'none' if such a file exists in the program's current directory.

12 May 2026 11:16Current

7.4High risk

Vulners AI Score7.4

CVSS 3.13.7

EPSS0.00441

SSVC