CVE-2023-27533
HIGHcurl < 8.0 - Remote Code Execution via TELNET Protocol Input Validation
Title source: llmDescription
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.
References (5)
Core 5
Core References
Exploit, Third Party Advisory
https://hackerone.com/reports/1891474
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230420-0011/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202310-12
Scores
CVSS v3
8.8
EPSS
0.0017
EPSS Percentile
38.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-74
CWE-75
Status
published
Products (10)
fedoraproject/fedora
36
haxx/curl
7.0.0 - 7.881
netapp/active_iq_unified_manager
netapp/clustered_data_ontap
9.0
netapp/h300s_firmware
netapp/h410s_firmware
netapp/h500s_firmware
netapp/h700s_firmware
splunk/universal_forwarder
9.1.0
splunk/universal_forwarder
8.2.0 - 8.2.12
Published
Mar 30, 2023
Tracked Since
Feb 18, 2026