SB2025010303 - Information disclosure in BIG-IQ Centralized Management libcurl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025010303

SB2025010303 - Information disclosure in BIG-IQ Centralized Management libcurl

Published: January 3, 2025

Security Bulletin ID SB2025010303
CSH Severity
Low
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Information disclosure (CVE-ID: CVE-2023-46218)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to an error in curl that allows a malicious HTTP server to set "super cookies" that are then passed back to more origins than what is otherwise allowed or possible. A remote attacker can force curl to send such cookie to different and unrelated sites and domains.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References