CVE-2022-32207

CRITICAL

9.8

Description

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/7/2022

Last Modified4/23/2025

Sourcenvd

Honeypot Sightings0

Affected Products

apple:macosdebian:debian_linuxfedoraproject:fedorahaxx:curlnetapp:bootstrap_osnetapp:clustered_data_ontapnetapp:element_softwarenetapp:h300snetapp:h300s_firmwarenetapp:h410snetapp:h410s_firmwarenetapp:h500snetapp:h500s_firmwarenetapp:h700snetapp:h700s_firmwarenetapp:hci_compute_nodenetapp:hci_management_nodenetapp:solidfiresplunk:universal_forwarder

Weaknesses (CWE)

CWE-840CWE-276

References

http://seclists.org/fulldisclosure/2022/Oct/28(support@hackerone.com)

http://seclists.org/fulldisclosure/2022/Oct/41(support@hackerone.com)

https://hackerone.com/reports/1573634(support@hackerone.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/(support@hackerone.com)

https://security.gentoo.org/glsa/202212-01(support@hackerone.com)

https://security.netapp.com/advisory/ntap-20220915-0003/(support@hackerone.com)

https://support.apple.com/kb/HT213488(support@hackerone.com)

https://www.debian.org/security/2022/dsa-5197(support@hackerone.com)

http://seclists.org/fulldisclosure/2022/Oct/28(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2022/Oct/41(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/1573634(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202212-01(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20220915-0003/(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213488(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2022/dsa-5197(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.