VULNERABILITY INTELLIGENCE

CVE-2022-32207

CVSS score9.8 CRITICAL
EPSS probability12.32%
CISA KEVNot currently listed
Published2022-07-07
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

Weakness classification

  • CWE-276: Incorrect Default Permissions

Primary references