« Volver al listado

CVE-2015-3236

Estado: ModificadaMedia (5)—

cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Haxx — CurlHaxx — Libcurl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-3236",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-06-22T19:59:03.683",
  "references": [
    {
      "url": "http://curl.haxx.se/docs/adv_20150617A.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/75385",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/91787",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10131",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/201509-02",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://curl.haxx.se/docs/adv_20150617A.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/75385",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/91787",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10131",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201509-02",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "cURL y libcurl 7.40.0 hasta la versión 7.42.1 mandan las credenciales de autenticación HTTP Basic de una conexión previa cuando se reutiliza en una conexión de reinicio (curl_easy_reset) usada para enviar una petición al mismo nombre de anfitrión, lo que permite a atacantes remotos obtener información sensible a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:25:35.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haxx:curl:7.40.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DEBBFCA-6A18-4F8F-B841-50255C952FA0"
            },
            {
              "criteria": "cpe:2.3:a:haxx:curl:7.41.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEEAE437-A645-468B-B283-44799658F534"
            },
            {
              "criteria": "cpe:2.3:a:haxx:curl:7.42.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03F7EE95-4EBE-4306-ADFE-A1A92CAD5F24"
            },
            {
              "criteria": "cpe:2.3:a:haxx:curl:7.42.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79F7AE71-7A18-4737-9C02-0A3343B3AD4C"
            },
            {
              "criteria": "cpe:2.3:a:haxx:libcurl:7.40.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D52E9E9F-7A35-4CB9-813E-5A1D4A36415C"
            },
            {
              "criteria": "cpe:2.3:a:haxx:libcurl:7.41.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "257291FB-969C-4413-BA81-806B5E1B40A7"
            },
            {
              "criteria": "cpe:2.3:a:haxx:libcurl:7.42.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88DC6ED5-4C1A-4ED0-97BA-B245C4A236C9"
            },
            {
              "criteria": "cpe:2.3:a:haxx:libcurl:7.42.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51AA7383-3AA1-4A3B-BA46-BBA8FBDC10DD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}