CVE-2015-3143

medium · 5

cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.

CVSS

12.8%

EPSS (exploit prob.)

96th

EPSS percentile

2015-04-24

Published

AV:N/AC:L/Au:N/C:N/I:P/A:N

Weaknesses

CWE-264

Affected products

Vendor	Product	Affected versions
haxx	curl	7.10.6
haxx	curl	7.10.7
haxx	curl	7.10.8
haxx	curl	7.11.0
haxx	curl	7.11.1
haxx	curl	7.11.2
haxx	curl	7.12.0
haxx	curl	7.12.1
haxx	curl	7.12.2
haxx	curl	7.12.3
haxx	curl	7.13.0
haxx	curl	7.13.1
haxx	curl	7.13.2
haxx	curl	7.14.0
haxx	curl	7.14.1
haxx	curl	7.15.0
haxx	curl	7.15.1
haxx	curl	7.15.2
haxx	curl	7.15.3
haxx	curl	7.15.4
haxx	curl	7.15.5
haxx	curl	7.16.0
haxx	curl	7.16.1
haxx	curl	7.16.2
haxx	curl	7.16.3
haxx	curl	7.16.4
haxx	curl	7.17.0
haxx	curl	7.17.1
haxx	curl	7.18.0
haxx	curl	7.18.1
haxx	curl	7.18.2
haxx	curl	7.19.0
haxx	curl	7.19.1
haxx	curl	7.19.2
haxx	curl	7.19.3
haxx	curl	7.19.4
haxx	curl	7.19.5
haxx	curl	7.19.6
haxx	curl	7.19.7
haxx	curl	7.20.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-3143