CVE-2023-23915

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-23915
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://hackerone.com/reports/1826048 Not Applicable
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230309-0006/ Third Party Advisory
https://hackerone.com/reports/1826048 Not Applicable
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230309-0006/ Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.0:-:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

OR cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
History

24 Oct 2026, 13:10

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de transmisión de información sensible en texto claro existe en curl anterior a v7.88.0 que podría causar que la funcionalidad HSTS se comporte incorrectamente cuando se solicitan múltiples URL en paralelo. Usando su soporte HSTS, se puede instruir a curl para que use HTTPS en lugar de usar un paso HTTP inseguro en texto claro incluso cuando se proporciona HTTP en la URL. Sin embargo, este mecanismo HSTS fallaría sorprendentemente cuando se realizan múltiples transferencias en paralelo ya que el archivo de caché HSTS se sobrescribe por la transferencia completada más recientemente. Una transferencia posterior solo HTTP al nombre de host anterior entonces *no* se actualizaría correctamente a HSTS.

14 Oct 2026, 23:17

Type Values Removed Values Added
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-398330.html -
Information

Published : 2023-02-23 20:15

Updated : 2026-10-24 13:10

NVD link : CVE-2023-23915

Mitre link : CVE-2023-23915

CVE.ORG link : CVE-2023-23915

JSON object : View

Products Affected

netapp

  • h500s
  • h700s_firmware
  • h300s_firmware
  • h410s
  • active_iq_unified_manager
  • h410s_firmware
  • h300s
  • h700s
  • clustered_data_ontap
  • h500s_firmware

splunk

  • universal_forwarder

haxx

  • curl
CWE
CWE-319

Cleartext Transmission of Sensitive Information