CVE-2003-1605: curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server

High severity · published Aug 23, 2018

CVE-2003-1605

curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server

7.5

CVSS

EPSS

On KEV

Description

curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.0% · higher than 80% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Curl · Haxx

7.1.0 before 7.10.7 · source: NVD

Affected product

Curl

Haxx

All Curl CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2003-1605

CVE.org

https://www.cve.org/CVERecord?id=CVE-2003-1605

Third Party Advisory

http://www.securityfocus.com/bid/8432

Vendor Advisory

https://curl.haxx.se/docs/CVE-2003-1605.html