CURL-CVE-2014-3620
- Source
- https://curl.se/docs/CVE-2014-3620.html
- Import Source
- https://curl.se/docs/CURL-CVE-2014-3620.json
- JSON Data
- https://api.osv.dev/v1/vulns/CURL-CVE-2014-3620
- Aliases
- Published
- 2014-09-10T08:00:00Z
- Modified
- 2024-06-07T13:53:51Z
- Summary
- cookie leak for TLDs
- Details
-
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain.
- Database specific
{ "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "package": "curl", "URL": "https://curl.se/docs/CVE-2014-3620.json", "severity": "High", "www": "https://curl.se/docs/CVE-2014-3620.html", "last_affected": "7.37.1" }- References
-
- Credits
-
-
- Tim Ruehsen - FINDER
-
- Daniel Stenberg - REMEDIATION_DEVELOPER
-