CVE-2022-32207
9.8
CRITICAL · CVSS 3.1 · EPSS 7.7% (pctl 94)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 7.74% — more likely to be exploited than 94% of all CVEs |
| Weakness | CWE-840 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2022-07-07 |
| Last modified | 2026-06-17 |
Affected (19)
| Vendor | Product |
|---|---|
| apple | macos |
| debian | debian linux |
| fedoraproject | fedora |
| haxx | curl |
| netapp | bootstrap os |
| netapp | clustered data ontap |
| netapp | element software |
| netapp | h300s |
| netapp | h300s firmware |
| netapp | h410s |
| netapp | h410s firmware |
| netapp | h500s |
| netapp | h500s firmware |
| netapp | h700s |
| netapp | h700s firmware |
| netapp | hci compute node |
| netapp | hci management node |
| netapp | solidfire |
| splunk | universal forwarder |
References
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/41
- https://hackerone.com/reports/1573634
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20220915-0003/
- https://support.apple.com/kb/HT213488
- https://www.debian.org/security/2022/dsa-5197
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/41
- https://hackerone.com/reports/1573634
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20220915-0003/
- https://support.apple.com/kb/HT213488
- https://www.debian.org/security/2022/dsa-5197
→ the Explorer · watch your stack · NVD