CVE-2023-27535
Severity
5.9MEDIUM
EPSS
0.1%
top 79.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 30
Description
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily.…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6
Affected Packages4 packages
Also affects: Debian Linux 10.0, Fedora 36
🔴Vulnerability Details
5📋Vendor Advisories
5Microsoft▶
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created conn↗2023-03-14
Debian▶
CVE-2023-27535: curl - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP conne...↗2023