CVE-2022-22576

Public on 2022-05-03
Modified on 2023-01-18
Description
A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials set for this transfer. This issue leads to an authentication bypass, either by mistake or by a malicious actor.
Severity
Medium severity
Medium
CVSS v3 Base Score
4.6
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 curl 2022-12-01 ALAS-2022-1646 Fixed
Amazon Linux 2 - Core curl 2022-05-04 ALAS2-2022-1792 Fixed
Amazon Linux 2023 curl 2023-02-17 ALAS2023-2023-083 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
NVD CVSSv3 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD CVSSv2 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N