CVE-2022-27776: broadcom fabric_operating_system Insufficiently Protected Credentials
CVSS: 6.5v3.1MediumModified
AliasesALPINE-CVE-2022-27776UBUNTU-CVE-2022-27776DEBIAN-CVE-2022-27776
Published 01-06-2022Last modified 14-10-2026
Vulnerability summary
CVE-2022-27776 is a medium (CVSS 6.5) Insufficiently Protected Credentials vulnerability in broadcom fabric_operating_system. EPSS estimates a 4.10% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
4.10%
0%100%
Low · +0.32 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 9 · Related 4Timeline
- 01-06-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
4.10%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
+0.32 pp
From 3.78% on 18-09-2026
18-09-202618-10-2026
EPSS score4.10%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Netapp8 products
Debian2 products
- curl< 7.83.0-1
- debian_linuxEOL10.0 | 11.0
Alpine1 product
- curl< 7.79.1-r1 | < 7.80.0-r1 | < 7.83.0-r0
Broadcom1 product
Brocade1 product
Fedoraproject1 product
- fedoraEOL36 | 37
Haxx1 product
- curl< 7.83.0
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Ubuntu1 product
- curlAll versions (No fix recorded) | < 7.58.0-2ubuntu3.17 | < 7.68.0-1ubuntu2.10 | < 7.81.0-1ubuntu1.1
9 vendors · 17 products
References
14 links- security.netapp.com/advisory/ntap-20220609-0008/Third Party Advisory
