CVE-2023-38546

Summary

CVE-2023-38546 is a vulnerability affecting libcurl's cookie handling. When an easy handle, which is an individual transfer handle, is cloned using the curl_easy_duphandle function, the cookie-enable state is copied but not the actual cookies. If the source handle did not load cookies from a file on disk, the cloned handle inadvertently loads cookies from a file named "none" in the current directory if it exists and is readable. This issue allows attackers to insert cookies into running programs using libcurl, potentially leading to unintended data access or hijacking.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.