EXPOSURES › CVE-2023-23914

CVE-2023-23914

CRITICAL

DETAIL

SourceNVD · cve Published2023-02-23 CVSS9.1 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2023-23914 ↗

▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.

PLAYERS IMPLICATED

NetApp · vendor Splunk · vendor haxx · vendor active iq unified manager · product clustered data ontap · product curl · product h300s · product h300s firmware · product h410s · product h410s firmware · product h500s · product h500s firmware · product h700s · product h700s firmware · product universal forwarder · product

DESCRIPTION

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

AFFECTED FEDRAMP PRODUCTS · 3

PRODUCT	PROVIDER	STATUS	MATCH
Cloud Insights NetApp	NetApp	In Process	vendor-exact · 0.90
Splunk Cloud Platform for FedRAMP High Splunk	Splunk	In Process	vendor-exact · 0.90
Splunk Cloud Platform for FedRAMP Moderate Splunk	Splunk	Authorized	vendor-exact · 0.90