VULNERABILITY INTELLIGENCE
CVE-2012-0036
CVSS score7.5 HIGH
EPSS probability16.12%
CISA KEVNot currently listed
Published2012-04-13
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Description
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.
Weakness classification
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')