CVE-2022-27778

https://github.com/curl/curl

HIGH 8.1

At a glance

Source: NVD
EPSS: EPSS 3.81 % · percentile 90 (2026-10-28)
State: PUBLISHED
Published: 2022-06-01 19:03 UTC
Updated: 2026-10-14 16:20 UTC
Assigner: hackerone
NVD status: Modified

Description

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

Weaknesses (CWE)

CWE-706 — Use of Incorrectly-Resolved Name or Reference

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.8	AV:N/AC:M/Au:N/C:N/I:P/A:P	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2022-32273
GCVE · GCVE-0-2022-27778

CERT-FR advisories

CERTFR-2023-AVI-1015 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
CERTFR-2023-AVI-0701 — Multiples vulnérabilités dans Splunk · cert.ssi.gouv.fr
CERTFR-2023-AVI-0428 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2022-AVI-655 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:haxx:curl:7.83.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bh500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* ≤ 5.7.38
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* ≥ 8.0.0 ≤ 8.0.29
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.12
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.6
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

Affected products

Product	Versions
https://github.com/curl/curl	affected fixed in 7.83.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD