CVE-2012-0036

high · 7.5

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.

7.5

CVSS

16.1%

EPSS (exploit prob.)

97th

EPSS percentile

2012-04-13

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
curl	curl	7.20.0
curl	curl	7.20.1
curl	curl	7.21.0
curl	curl	7.21.1
curl	curl	7.21.2
curl	curl	7.21.3
curl	curl	7.21.4
curl	curl	7.21.5
curl	curl	7.21.6
curl	curl	7.21.7
curl	curl	7.22.0
curl	curl	7.23.0
curl	curl	7.23.1
curl	libcurl	7.20.0
curl	libcurl	7.20.1
curl	libcurl	7.21.0
curl	libcurl	7.21.1
curl	libcurl	7.21.2
curl	libcurl	7.21.3
curl	libcurl	7.21.4
curl	libcurl	7.21.5
curl	libcurl	7.21.6
curl	libcurl	7.21.7
curl	libcurl	7.22.0
curl	libcurl	7.23.0
curl	libcurl	7.23.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2012-0036