VULNERABILITY INTELLIGENCE

CVE-2015-3153

CVSS score5 MEDIUM
EPSS probability7.34%
CISA KEVNot currently listed
Published2015-05-01
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:P/I:N/A:N

Description

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references