cookie for trailing dot TLD
libcurl wrongly allows HTTP cookies to be set for Top Level Domains (TLDs) if the hostname is provided with a trailing dot. curl can be told to receive and send cookies when communicating using HTTP(S). curl's "cookie engine" can be built with or without [Public Suffix List](https://publicsuffix.org/) awareness. If PSL support not provided, a more rudimentary check exists to at least prevent cookies from being set on TLDs. This check was broken if the hostname in the URL uses a trailing dot. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-27779US | medium5.3OT erhöht | — | ||
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie e… | ||||
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan