4.3
CVE-2022-30115
- EPSS 1.26%
- Veröffentlicht 02.06.2022 14:15:51
- Zuletzt bearbeitet 21.11.2024 07:02:11
- Erkennungen
LoginUsing its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netapp ≫ Hci Bootstrap Os Version -
Netapp ≫ Clustered Data Ontap Version -
Netapp ≫ Solidfire, Enterprise Sds & Hci Storage Node Version -
Netapp ≫ Solidfire & Hci Management Node Version -
Netapp ≫ H300s Firmware Version -
Netapp ≫ H500s Firmware Version -
Netapp ≫ H700s Firmware Version -
Netapp ≫ H410s Firmware Version -
Splunk ≫ Universal Forwarder Version >= 8.2.0 < 8.2.12
Splunk ≫ Universal Forwarder Version >= 9.0.0 < 9.0.6
Splunk ≫ Universal Forwarder Version 9.1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.26% | 0.672 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| NIST | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
CWE-319 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-325 Missing Cryptographic Step
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
https://security.gentoo.org/glsa/202212-01
https://security.netapp.com/advisory/ntap-20220609-0009/
http://www.openwall.com/lists/oss-security/2022/10/26/4
http://www.openwall.com/lists/oss-security/2022/12/21/1
https://hackerone.com/reports/1557449