CVE-2022-35252: apple macos Improper Input Validation
CVSS: 3.7v3.1LowModified
AliasesALPINE-CVE-2022-35252MGASA-2022-0333SUSE-SU-2022:3003-1SUSE-SU-2022:3004-1SUSE-SU-2022:3005-1UBUNTU-CVE-2022-35252USN-5587-1DEBIAN-CVE-2022-35252openSUSE-SU-2024:12293-1
Published 23-09-2022Last modified 14-10-2026
Vulnerability summary
CVE-2022-35252 is a low (CVSS 3.7) Improper Input Validation vulnerability in apple macos. EPSS estimates a 3.84% chance of exploitation in the next 30 days, higher than 90% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
3.7/10
010
Low · v3.1 (CVE.org)EPSS score
3.84%
0%100%
Low · +1.90 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 7 · Related 2Timeline
- 23-09-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
CVSS metrics
5 scores · 5 sources · 1 versionLow 3.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
3.84%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
+1.90 pp
From 1.95% on 19-09-2026
19-09-202619-10-2026
EPSS score3.84%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Netapp9 products
Suse7 products
- curl&distro=SUSE Linux Enterprise Micro 5.1< 7.66.0-150200.4.39.1
- curl&distro=SUSE Linux Enterprise Micro 5.2< 7.66.0-150200.4.39.1
- curl&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 7.66.0-150200.4.39.1
- curl&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 7.79.1-150400.5.6.1
- curl&distro=SUSE Linux Enterprise Server 12 SP5< 7.60.0-11.46.1
Opensuse4 products
- curl&distro=openSUSE Leap 15.3< 7.66.0-150200.4.39.1
- curl&distro=openSUSE Leap 15.4< 7.79.1-150400.5.6.1
- curl&distro=openSUSE Leap Micro 5.2< 7.66.0-150200.4.39.1
- curl&distro=openSUSE Tumbleweed< 7.85.0-1.1
Debian2 products
- curl< 7.85.0-1
- debian_linuxEOL10.0
Alpine1 product
- curl< 7.79.1-r3 | < 7.80.0-r3 | < 7.83.1-r3 | < 7.85.0-r0
Apple1 product
- macos≥ 11.0, < 11.7.3 | ≥ 12.0.0, < 12.6.3
Haxx1 product
- curl< 7.85.0
Mageia1 product
- curl< 7.74.0-1.8.mga8
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Ubuntu1 product
- curl< 7.35.0-1ubuntu2.20+esm12 | < 7.47.0-1ubuntu2.19+esm5 | < 7.58.0-2ubuntu3.20 | < 7.68.0-1ubuntu2.13 | < 7.81.0-1ubuntu1.4
10 vendors · 28 products
References
29 links- security.netapp.com/advisory/ntap-20220930-0005/Third Party Advisory
- support.apple.com/kb/HT213603Third Party Advisory
- support.apple.com/kb/HT213604Third Party Advisory
