Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-s73y-y7v7-43cm
Vulnerability ID VCID-s73y-y7v7-43cm
Aliases CVE-2023-28322
Summary Multiple vulnerabilities have been discovered in curl, the worst of which could result in arbitrary code execution.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-440 Expected Behavior Violation
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28322.json
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
epss 0.00631 https://api.first.org/data/v1/epss?cve=CVE-2023-28322
cvssv3.1 Low https://curl.se/docs/CVE-2023-28322.html
cvssv3.1 5.3 http://seclists.org/fulldisclosure/2023/Jul/47
ssvc Track http://seclists.org/fulldisclosure/2023/Jul/47
cvssv3.1 5.3 http://seclists.org/fulldisclosure/2023/Jul/48
ssvc Track http://seclists.org/fulldisclosure/2023/Jul/48
cvssv3.1 5.3 http://seclists.org/fulldisclosure/2023/Jul/52
ssvc Track http://seclists.org/fulldisclosure/2023/Jul/52
cvssv3.1 6.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.3 https://hackerone.com/reports/1954658
ssvc Track https://hackerone.com/reports/1954658
cvssv3.1 5.3 https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
cvssv3.1 5.3 https://security.gentoo.org/glsa/202310-12
ssvc Track https://security.gentoo.org/glsa/202310-12
cvssv3.1 5.3 https://security.netapp.com/advisory/ntap-20230609-0009/
ssvc Track https://security.netapp.com/advisory/ntap-20230609-0009/
cvssv3.1 5.3 https://support.apple.com/kb/HT213843
ssvc Track https://support.apple.com/kb/HT213843
cvssv3.1 5.3 https://support.apple.com/kb/HT213844
ssvc Track https://support.apple.com/kb/HT213844
cvssv3.1 5.3 https://support.apple.com/kb/HT213845
ssvc Track https://support.apple.com/kb/HT213845
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28322.json
https://api.first.org/data/v1/epss?cve=CVE-2023-28322
https://curl.se/docs/CVE-2023-28322.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28322
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://hackerone.com/reports/1954658
1036239 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036239
2196793 https://bugzilla.redhat.com/show_bug.cgi?id=2196793
47 http://seclists.org/fulldisclosure/2023/Jul/47
48 http://seclists.org/fulldisclosure/2023/Jul/48
52 http://seclists.org/fulldisclosure/2023/Jul/52
F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
GLSA-202310-12 https://security.gentoo.org/glsa/202310-12
HT213843 https://support.apple.com/kb/HT213843
HT213844 https://support.apple.com/kb/HT213844
HT213845 https://support.apple.com/kb/HT213845
msg00015.html https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
ntap-20230609-0009 https://security.netapp.com/advisory/ntap-20230609-0009/
RHSA-2023:4354 https://access.redhat.com/errata/RHSA-2023:4354
RHSA-2023:4628 https://access.redhat.com/errata/RHSA-2023:4628
RHSA-2023:4629 https://access.redhat.com/errata/RHSA-2023:4629
RHSA-2023:5598 https://access.redhat.com/errata/RHSA-2023:5598
RHSA-2024:0428 https://access.redhat.com/errata/RHSA-2024:0428
RHSA-2024:0585 https://access.redhat.com/errata/RHSA-2024:0585
RHSA-2024:1601 https://access.redhat.com/errata/RHSA-2024:1601
RHSA-2024:2092 https://access.redhat.com/errata/RHSA-2024:2092
RHSA-2024:2093 https://access.redhat.com/errata/RHSA-2024:2093
USN-6237-1 https://usn.ubuntu.com/6237-1/
USN-6237-3 https://usn.ubuntu.com/6237-3/
Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28322.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at http://seclists.org/fulldisclosure/2023/Jul/47
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at http://seclists.org/fulldisclosure/2023/Jul/47
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at http://seclists.org/fulldisclosure/2023/Jul/48
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at http://seclists.org/fulldisclosure/2023/Jul/48
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at http://seclists.org/fulldisclosure/2023/Jul/52
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at http://seclists.org/fulldisclosure/2023/Jul/52
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://hackerone.com/reports/1954658
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://hackerone.com/reports/1954658
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://security.gentoo.org/glsa/202310-12
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://security.gentoo.org/glsa/202310-12
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://security.netapp.com/advisory/ntap-20230609-0009/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://security.netapp.com/advisory/ntap-20230609-0009/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://support.apple.com/kb/HT213843
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://support.apple.com/kb/HT213843
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://support.apple.com/kb/HT213844
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://support.apple.com/kb/HT213844
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://support.apple.com/kb/HT213845
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-13T19:43:16Z/ Found at https://support.apple.com/kb/HT213845
Exploit Prediction Scoring System (EPSS)
Percentile 0.70238
EPSS Score 0.00631
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:10:28.595463+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202310-12 38.0.0