Search for vulnerabilities
Vulnerability details: VCID-9yvj-e9uf-9fcv
Vulnerability ID VCID-9yvj-e9uf-9fcv
Aliases CVE-2024-2004
Summary When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-115 Misinterpretation of Input
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2004.json
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.00617 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
epss 0.0091 https://api.first.org/data/v1/epss?cve=CVE-2024-2004
cvssv3.1 3.5 https://curl.se/docs/CVE-2024-2004.html
cvssv3.1 Low https://curl.se/docs/CVE-2024-2004.html
ssvc Track https://curl.se/docs/CVE-2024-2004.html
cvssv3.1 3.5 https://curl.se/docs/CVE-2024-2004.json
ssvc Track https://curl.se/docs/CVE-2024-2004.json
cvssv3.1 3.5 http://seclists.org/fulldisclosure/2024/Jul/18
ssvc Track http://seclists.org/fulldisclosure/2024/Jul/18
cvssv3.1 3.5 http://seclists.org/fulldisclosure/2024/Jul/19
ssvc Track http://seclists.org/fulldisclosure/2024/Jul/19
cvssv3.1 3.5 http://seclists.org/fulldisclosure/2024/Jul/20
ssvc Track http://seclists.org/fulldisclosure/2024/Jul/20
cvssv3.1 3.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 3.5 https://hackerone.com/reports/2384833
ssvc Track https://hackerone.com/reports/2384833
cvssv3.1 3.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
cvssv3.1 3.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
cvssv3.1 3.5 https://security.netapp.com/advisory/ntap-20240524-0006/
ssvc Track https://security.netapp.com/advisory/ntap-20240524-0006/
cvssv3.1 3.5 https://support.apple.com/kb/HT214118
ssvc Track https://support.apple.com/kb/HT214118
cvssv3.1 3.5 https://support.apple.com/kb/HT214119
ssvc Track https://support.apple.com/kb/HT214119
cvssv3.1 3.5 https://support.apple.com/kb/HT214120
ssvc Track https://support.apple.com/kb/HT214120
cvssv3.1 3.5 http://www.openwall.com/lists/oss-security/2024/03/27/1
ssvc Track http://www.openwall.com/lists/oss-security/2024/03/27/1
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2004.json
https://api.first.org/data/v1/epss?cve=CVE-2024-2004
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1 http://www.openwall.com/lists/oss-security/2024/03/27/1
18 http://seclists.org/fulldisclosure/2024/Jul/18
19 http://seclists.org/fulldisclosure/2024/Jul/19
20 http://seclists.org/fulldisclosure/2024/Jul/20
2270500 https://bugzilla.redhat.com/show_bug.cgi?id=2270500
2384833 https://hackerone.com/reports/2384833
2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
CVE-2024-2004 https://nvd.nist.gov/vuln/detail/CVE-2024-2004
CVE-2024-2004.html https://curl.se/docs/CVE-2024-2004.html
CVE-2024-2004.json https://curl.se/docs/CVE-2024-2004.json
GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
HT214118 https://support.apple.com/kb/HT214118
HT214119 https://support.apple.com/kb/HT214119
HT214120 https://support.apple.com/kb/HT214120
ntap-20240524-0006 https://security.netapp.com/advisory/ntap-20240524-0006/
RHSA-2024:2693 https://access.redhat.com/errata/RHSA-2024:2693
RHSA-2024:2694 https://access.redhat.com/errata/RHSA-2024:2694
USN-6718-1 https://usn.ubuntu.com/6718-1/
USN-6718-3 https://usn.ubuntu.com/6718-3/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2004.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://curl.se/docs/CVE-2024-2004.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://curl.se/docs/CVE-2024-2004.html
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://curl.se/docs/CVE-2024-2004.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://curl.se/docs/CVE-2024-2004.json
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at http://seclists.org/fulldisclosure/2024/Jul/18
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at http://seclists.org/fulldisclosure/2024/Jul/18
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at http://seclists.org/fulldisclosure/2024/Jul/19
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at http://seclists.org/fulldisclosure/2024/Jul/19
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at http://seclists.org/fulldisclosure/2024/Jul/20
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at http://seclists.org/fulldisclosure/2024/Jul/20
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://hackerone.com/reports/2384833
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://hackerone.com/reports/2384833
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://security.netapp.com/advisory/ntap-20240524-0006/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://security.netapp.com/advisory/ntap-20240524-0006/
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://support.apple.com/kb/HT214118
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://support.apple.com/kb/HT214118
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://support.apple.com/kb/HT214119
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://support.apple.com/kb/HT214119
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://support.apple.com/kb/HT214120
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at https://support.apple.com/kb/HT214120
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2024/03/27/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T18:17:42Z/ Found at http://www.openwall.com/lists/oss-security/2024/03/27/1
Exploit Prediction Scoring System (EPSS)
Percentile 0.62957
EPSS Score 0.00455
Published At Aug. 4, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:36:11.485603+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/6718-3/ 37.0.0