percent-encoded path separator in URL host
The curl URL parser wrongly accepts percent-encoded URL separators like '/' when decoding the hostname part of a URL, making it a *different* URL using the wrong hostname when it is later retrieved. For example, a URL like `http://example.com%2F10.0.0.1/`, would be allowed by the parser and get transposed into `http://example.com/10.0.0.1/`. This flaw can be used to circumvent filters, checks and more.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-27780US | high7.5 | — | ||
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it i… | ||||
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan