CVE-2009-0037: The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might…

PriorityP342medium6.8CVSS 2.0

AVNACMAuNCPIPAP

EXPLOIT

EPSS

7.81%

93.9th percentile

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

Affected

87 ranges· showing 25

Vendor	Product	Version range	Fixed in
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv6.8MEDIUM

vendor_debian6.8MEDIUM

vendor_redhat6.8MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.