CVE-2022-35252

Published: Sep 23, 2022Modified: Oct 14, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Affected (16)

Products: Haxx: Curl · Netapp: Clustered Data Ontap, Element Software, Hci Management Node, Solidfire, Bootstrap Os, H300s Firmware, H500s Firmware, H700s Firmware, H410s Firmware · Apple: Macos · +2 more

Show all products

Haxx: Curl · Netapp: Clustered Data Ontap, Element Software, Hci Management Node, Solidfire, Bootstrap Os, H300s Firmware, H500s Firmware, H700s Firmware, H410s Firmware · Apple: Macos · Debian: Debian Linux · Splunk: Universal Forwarder

1 product

9 products

Clustered Data Ontap

Element Software

Hci Management Node

1 product

1 product

1 product

Universal Forwarder

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	version < 7.85.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Clustered Data Ontap	All versions
Netapp Element Software	All versions
Netapp Hci Management Node	All versions
Netapp Solidfire	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Bootstrap Os	All versions

Running on/with	Platform Versions
Netapp Hci Compute Node	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration H

2 vulnerable

Vulnerable Software	Affected Versions
Apple Macos	11.0 ≤ version < 11.7.3
Apple Macos	12.0.0 ≤ version < 12.6.3

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration J

3 vulnerable

Vulnerable Software	Affected Versions
Splunk Universal Forwarder	8.2.0 ≤ version < 8.2.12
Splunk Universal Forwarder	9.0.0 ≤ version < 9.0.6
Splunk Universal Forwarder	Version 9.1.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (21)

http://seclists.org/fulldisclosure/2023/Jan/20

Source: support@hackerone.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2023/Jan/21

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://hackerone.com/reports/1613943

Source: support@hackerone.com

ExploitIssue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202212-01

Source: support@hackerone.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220930-0005/

Source: support@hackerone.com

Third Party Advisory

https://support.apple.com/kb/HT213603

Source: support@hackerone.com

Third Party Advisory

https://support.apple.com/kb/HT213604

Source: support@hackerone.com

Third Party Advisory

http://seclists.org/fulldisclosure/2023/Jan/20

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2023/Jan/21

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://hackerone.com/reports/1613943

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202212-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220930-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT213603

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT213604

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-419740.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-558014.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-892048.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-942865.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.