CVE search · CVE-2024-11053
CVE-2024-11053
low 3.4
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
Details
- Status
- Modified
- Published
- Last changed
- Source
- 2499f714-1537-4658-8207-48ae4bb9eae9
- Weakness
- NVD-CWE-noinfo
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | low 3.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- haxx · curl
- netapp · ontap
- netapp · ontap_select_deploy_administration_utility
- netapp · h610c_firmware
- netapp · h610s_firmware
- netapp · h615c_firmware
- netapp · h700s_firmware
- netapp · bootstrap_os
- netapp · h300s_firmware
- netapp · h410s_firmware
- netapp · h500s_firmware
References
- https://curl.se/docs/CVE-2024-11053.htmlVendor Advisory
- https://curl.se/docs/CVE-2024-11053.jsonVendor Advisory
- https://hackerone.com/reports/2829063ExploitIssue TrackingThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/12/11/1Mailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20250124-0012/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20250131-0003/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20250131-0004/
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://cert-portal.siemens.com/productcert/html/ssa-212953.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html