Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2022-32207 Details
Description
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2025Exploitation: PocAutomatable: YesTechnical Impact: Total
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-276 | Incorrect Default Permissions | [email protected] |
| CWE-840 | Business Logic Errors | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.69.0, < 7.84.0 |
CPE
Remediation
| |
| fedoraproject fedora | 35 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
| netapp clustered data ontap | All versions |
CPE
Remediation
| |
| netapp element software | All versions |
CPE
Remediation
| |
| netapp hci management node | All versions |
CPE
Remediation
| |
| netapp solidfire | All versions |
CPE
Remediation
| |
| netapp hci compute node | All versions |
CPE
Remediation
| |
| netapp bootstrap os | All versions |
CPE
Remediation
| |
| netapp h300s | All versions |
CPE
Remediation
| |
| netapp h300s firmware | All versions |
CPE
Remediation
| |
| netapp h500s | All versions |
CPE
Remediation
| |
| netapp h500s firmware | All versions |
CPE
Remediation
| |
| netapp h700s | All versions |
CPE
Remediation
| |
| netapp h700s firmware | All versions |
CPE
Remediation
| |
| netapp h410s | All versions |
CPE
Remediation
| |
| netapp h410s firmware | All versions |
CPE
Remediation
| |
| apple macos | < 13.0 |
CPE
Remediation
| |
| splunk universal forwarder | >= 8.2.0, < 8.2.12 >= 9.0.0, < 9.0.6 9.1.0 |
CPE
Remediation
| |
Change History
18 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 23, 2025 | CVE Modified | CISA-ADP |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Mar 27, 2024 | Modified Analysis | [email protected] |
| Nov 7, 2023 | CVE Modified | [email protected] |
| Mar 28, 2023 | Reanalysis | [email protected] |
| Jan 5, 2023 | Modified Analysis | [email protected] |
| Dec 19, 2022 | CVE Modified | [email protected] |
| Nov 4, 2022 | Modified Analysis | [email protected] |
| Oct 30, 2022 | CVE Modified | [email protected] |
| Oct 25, 2022 | CVE Modified | [email protected] |
| Sep 16, 2022 | Modified Analysis | [email protected] |
| Sep 15, 2022 | CVE Modified | [email protected] |
| Aug 2, 2022 | CVE Modified | [email protected] |
| Jul 15, 2022 | CVE Modified | [email protected] |
| Jul 14, 2022 | Initial Analysis | [email protected] |