CVE-2023-38546
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.…
- Published
- Updated
- Reserved
- Assigned by
- hackerone
Description
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.
Timeline
ID reserved
By hackerone
- 3 months later
· 3 months later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Low3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 6.0% · top 6.7% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.
Affected products
References (15)
- https://curl.se/docs/CVE-2023-38546.html (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/ (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT214036 (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT214063 (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT214057 (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT214058 (opens in a new tab)x_transferred
- http://seclists.org/fulldisclosure/2024/Jan/34 (opens in a new tab)x_transferred
- http://seclists.org/fulldisclosure/2024/Jan/37 (opens in a new tab)x_transferred
- http://seclists.org/fulldisclosure/2024/Jan/38 (opens in a new tab)x_transferred
- https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868 (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-943925.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-832273.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-093430.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-38546)Record last updated .