Home > Vulnerability Database > CVE-2013-1944

Mend.io Vulnerability Database

CVE-2013-1944

Good to know:

Date: April 29, 2013

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.

Language: C

Severity Score

5.3

Related Resources (28)

Url: http://secunia.com/advisories/53097

Url: http://www.ubuntu.com/usn/USN-1801-1

Url: https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0121

Url: http://www.osvdb.org/92316

Url: http://www.debian.org/security/2012/dsa-2660

Url: http://secunia.com/advisories/53051

Url: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102711.html

Url: https://bugzilla.redhat.com/show_bug.cgi?id=950577

Url: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102056.html

Url: https://github.com/bagder/curl/commit/2eb8dcf26cb37f09cffe26909a646e702dbcab66

Url: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105539.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2013-1944

Url: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104598.html

Url: http://lists.opensuse.org/opensuse-updates/2013-06/msg00016.html

Url: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106606.html

Url: http://secunia.com/advisories/53044

Url: http://curl.haxx.se/docs/adv_20130412.html

Url: http://lists.opensuse.org/opensuse-updates/2013-06/msg00013.html

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2013:151

Url: http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Url: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104207.html

Url: http://rhn.redhat.com/errata/RHSA-2013-0771.html

Url: https://security-tracker.debian.org/tracker/CVE-2013-1944

Url: http://www.securityfocus.com/bid/59058

Url: https://access.redhat.com/security/cve/CVE-2013-1944

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2013-1944

Url: http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html

Url: https://www.mend.io/vulnerability-database/CVE-2013-1944

Severity Score

5.3

Weakness Type (CWE)

Information Leak / Disclosure

CWE-200

Insertion of Sensitive Information Into Sent Data

CWE-201

Top Fix

Upgrade Version

Upgrade to version 7.30.0

Learn More

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2013-1944

Good to know:

Date: April 29, 2013

Language: C

Severity Score

Related Resources (28)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?