CVE-2022-27778CWE-706

CVE-2022-27778

High · published June 2, 2022

CVSS v3.1
8.1
EPSS
4%
Percentile
90.0
In the wild
Unconfirmed
What it is

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03808 · 90.0th percentile
Weakness
CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2022-06-02T18:15Z
Affected products (18)
ProductVersionsFixed in
haxx/curlall versions—
netapp/active_iq_unified_managerall versions—
netapp/active_iq_unified_managerall versions—
netapp/clustered_data_ontapall versions—
netapp/oncommand_insightall versions—
netapp/oncommand_workflow_automationall versions—
netapp/snapcenterall versions—
netapp/solidfire_\&_hci_management_nodeall versions—
netapp/h300s_firmwareall versions—
netapp/bh500s_firmwareall versions—
netapp/h700s_firmwareall versions—
netapp/h410s_firmwareall versions—
netapp/hci_compute_node_firmwareall versions—
oracle/mysql_server≤ 5.7.38—
oracle/mysql_server≥ 8.0.0, ≤ 8.0.29—
splunk/universal_forwarder≥ 8.2.0, < 8.2.128.2.12
splunk/universal_forwarder≥ 9.0.0, < 9.0.69.0.6
splunk/universal_forwarderall versions—
References (9)
EPSS history
Timeline
  • 01 JUN 19:03Z
    A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`
    cvelistv5