CVE-2014-3620: Medium severity curl vulnerability
Published Nov 18, 2014
·Updated
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
Affected Software
17 affected components
haxx curl<=7.37.1
haxx curl=7.31.0
haxx curl=7.32.0
haxx curl=7.33.0
haxx curl=7.34.0
haxx curl=7.35.0
haxx curl=7.36.0
haxx curl=7.37.0
haxx libcurl<=7.37.1
haxx libcurl=7.31.0
haxx libcurl=7.32.0
haxx libcurl=7.33.0
haxx libcurl=7.34.0
haxx libcurl=7.35.0
haxx libcurl=7.36.0
haxx libcurl=7.37.0
Apple iOS and macOS<=10.10.4
Remediation
Patch Available
Event History
Nov 18, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3620?
CVE-2014-3620 is categorized as a medium severity vulnerability due to the potential for cookie theft and data manipulation.
2
How do I fix CVE-2014-3620?
To fix CVE-2014-3620, upgrade cURL or libcurl to version 7.38.0 or later.
3
What affected software versions are associated with CVE-2014-3620?
CVE-2014-3620 affects cURL and libcurl versions from 7.31.0 to 7.37.1.
4
What are the main risks of CVE-2014-3620?
The main risks of CVE-2014-3620 include unauthorized access to cookies and possible session hijacking.
5
Is CVE-2014-3620 exploitable remotely?
Yes, CVE-2014-3620 can be exploited by remote attackers to bypass the Same Origin Policy.