CVE-2023-38546

CVSS 3.1 Score 3.7 of 10 (low)

Details

Published Oct 18, 2023
Updated: Jan 26, 2024
CWE ID 20

Summary

CVE-2023-38546 is a vulnerability that affects the libcurl library, specifically the [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html) function. This flaw allows an attacker to insert cookies into a running program using libcurl, under certain conditions. The vulnerability arises when a transfer with enabled cookies is duplicated, but the actual cookies are not cloned. Instead, the cloned handle stores the file name as `none`, inadvertently loading cookies from a file named `none` if it exists and is readable in the program's current directory. This vulnerability has a low base severity and requires no privileges or user interaction to exploit. It poses a potential risk to an organization's integrity, but not confidentiality or availability. Remediation for this vulnerability involves updating the libcurl library to fix the issue.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-38546 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options