CVE-2023-27533

moderate-risk
Published 2023-03-30

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

Do I need to act?

-
0.17% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (10)

Affected Vendors

Haxx Fedoraproject Netapp Splunk

References (10)

Exploit https://hackerone.com/reports/1891474
Mailing List https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html
Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202310-12
Third Party Advisory https://security.netapp.com/advisory/ntap-20230420-0011/
Exploit https://hackerone.com/reports/1891474
Mailing List https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html
Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202310-12
Third Party Advisory https://security.netapp.com/advisory/ntap-20230420-0011/
47
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 1/34 · Minimal
Exposure 16/34 · Moderate