CVE-2022-22576: broadcom fabric_operating_system Improper Authentication
Vulnerability summary
CVE-2022-22576 is a high (CVSS 8.1) Improper Authentication vulnerability in broadcom fabric_operating_system. EPSS estimates a 2.52% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 4Timeline
- 26-05-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
2.52%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
+0.36 pp
From 2.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Netapp8 products
Debian2 products
- curl< 7.83.0-1
- debian_linuxEOL10.0 | 11.0
Alpine1 product
- curl≥ 7.33.0, < 7.79.1-r1 | ≥ 7.33.0, < 7.80.0-r1 | ≥ 7.33.0, < 7.83.0-r0
Broadcom1 product
Brocade1 product
Haxx1 product
- curl≥ 7.33.0, < 7.83.0
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Ubuntu1 product
- curlAll versions (No fix recorded) | < 7.58.0-2ubuntu3.17 | < 7.68.0-1ubuntu2.10 | < 7.81.0-1ubuntu1.1
8 vendors · 16 products
References
13 links- security.netapp.com/advisory/ntap-20220609-0008/Third Party Advisory
