CVE-2022-27779

    Dashboard / Vulnerabilities / CVE-2022-27779

    CVE-2022-27779

    Published: 1 Jun 2022Last Modified: 24 Oct 2026

    Summary:

    Details: libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

    References: https://cert-portal.siemens.com/productcert/html/ssa-398330.html, https://hackerone.com/reports/1553301, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27779.json, https://nvd.nist.gov/vuln/detail/CVE-2022-27779, https://security.gentoo.org/glsa/202212-01, https://security.netapp.com/advisory/ntap-20220609-0009/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 64db5c575d9c5536bd273a890f50777ad1ca7c13
    Fixed -462196e6b4a47f924293a0e26b8e9c23d37ac26f

    Affected versions

    curl-7_83_0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-27779 | CVE-DB