Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2014-2522
HistoryApr 18, 2014 - 10:14 p.m.

CVE-2014-2522

2014-04-1822:14:38
CWE-20
[email protected]
web.nvd.nist.gov
8

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

Affected configurations

Nvd
Node
haxxcurlMatch7.27.0
OR
haxxcurlMatch7.28.0
OR
haxxcurlMatch7.28.1
OR
haxxcurlMatch7.29.0
OR
haxxcurlMatch7.30.0
OR
haxxcurlMatch7.31.0
OR
haxxcurlMatch7.32.0
OR
haxxcurlMatch7.33.0
OR
haxxcurlMatch7.34.0
OR
haxxcurlMatch7.35.0
OR
haxxlibcurlMatch7.27.0
OR
haxxlibcurlMatch7.28.0
OR
haxxlibcurlMatch7.28.1
OR
haxxlibcurlMatch7.29.0
OR
haxxlibcurlMatch7.30.0
OR
haxxlibcurlMatch7.31.0
OR
haxxlibcurlMatch7.32.0
OR
haxxlibcurlMatch7.33.0
OR
haxxlibcurlMatch7.34.0
OR
haxxlibcurlMatch7.35.0
OR
haxxlibcurlMatch7.36.0
AND
microsoftwindows

Related

seebug 1
cvelist 1
f5 2
prion 1
veracode 1
debiancve 1
ubuntucve 1
cve 1
ibm 2
slackware 1
nessus 3
securityvulns 2
openvas 2
hackerone 1
seebug
seebug
cURL/libcURL SSL证书验证安全限制绕过漏洞
2014-03-21 00:00:00
cvelist
cvelist
CVE-2014-2522
2014-04-18 19:00:00
f5
f5
SOL15873 - cURL/libcURL vulnerability CVE-2014-2522
2014-11-27 00:00:00
K15873 : cURL/libcURL vulnerability CVE-2014-2522
2014-11-27 00:00:00
prion
prion
Code injection
2014-04-18 22:14:00
veracode
veracode
Improper Validation
2018-08-13 17:40:23
debiancve
debiancve
CVE-2014-2522
2014-04-18 22:14:38
ubuntucve
ubuntucve
CVE-2014-2522
2014-04-18 00:00:00
cve
cve
CVE-2014-2522
2014-04-18 22:14:38
ibm
ibm
Security Bulletin: IBM ToolsCenter is affected by several cURL potential vulnerabilities (CVE-2014-0015, CVE-2014-0139, CVE-2014-0138, CVE-2014-2522)
2019-01-31 01:25:01
Security Bulletin: Vulnerabilities affect IBM's Advanced Management Module (AMM)
2023-04-14 14:32:25
slackware
slackware
[slackware-security] curl
2014-03-28 22:53:36
nessus
nessus
Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2014-086-01)
2014-03-31 00:00:00
EulerOS Virtualization 2.5.3 : curl (EulerOS-SA-2019-1172)
2019-04-09 00:00:00
HP System Management Homepage < 7.2.6 Multiple Vulnerabilities (FREAK)
2016-03-29 00:00:00
securityvulns
securityvulns
[slackware-security] curl &#40;SSA:2014-086-01&#41;
2014-04-01 00:00:00
curl multiple security vulnerabilities
2014-04-01 00:00:00
openvas
openvas
Slackware: Security Advisory (SSA:2014-086-01)
2022-04-21 00:00:00
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2019-1172)
2020-01-23 00:00:00
hackerone
hackerone
curl: CVE-2024-2466: TLS certificate check bypass with mbedTLS
2024-03-14 11:49:49

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON
Related for NVD:CVE-2014-2522
seebug1cvelist1f52prion1veracode1debiancve1ubuntucve1cve1ibm2slackware1nessus3securityvulns2openvas2hackerone1