CVE-2023-46218 json
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to...
published 2023-12-07 2 y ago modified 2026-10-15 25 d ago also EUVD-2023-50460 , GHSA-59mm-6rr4-j9p2 , JLSEC-2026-411
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
Patch / fix
- julia CURL_jll 8.5.0+0
- julia LibCURL_jll 8.5.0+0
- Siemens RUGGEDCOM ROX MX5000 V2.17.0
- Siemens RUGGEDCOM ROX MX5000RE V2.17.0
- Siemens RUGGEDCOM ROX RX1400 V2.17.0
- Siemens RUGGEDCOM ROX RX1500 V2.17.0
- Siemens RUGGEDCOM ROX RX1501 V2.17.0
- Siemens RUGGEDCOM ROX RX1510 V2.17.0
- Siemens RUGGEDCOM ROX RX1511 V2.17.0
- Siemens RUGGEDCOM ROX RX1512 V2.17.0
- Siemens RUGGEDCOM ROX RX1524 V2.17.0
- Siemens RUGGEDCOM ROX RX1536 V2.17.0
- Siemens RUGGEDCOM ROX RX5000 V2.17.0
- Siemens SINEC NMS V3.0 SP1
- curl Debian 12 7.88.1-10+deb12u5
- curl Debian 14, Debian 13 8.5.0-1
debian advisories DEBIAN-CVE-2023-46218
- curl Ubuntu 20.04 LTS 7.68.0-1ubuntu2.21
- curl Ubuntu 22.04 LTS 7.81.0-1ubuntu1.15
- curl Ubuntu Pro 16.04 LTS 7.47.0-1ubuntu2.19+esm11
- curl Ubuntu Pro 18.04 LTS 7.58.0-2ubuntu3.24+esm3
ubuntu advisories UBUNTU-CVE-2023-46218
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- jbcs-httpd24-curl jboss core services 1 8.6.0-3.el7jbcs
- jbcs-httpd24-curl jboss core services 1 8.6.0-3.el8jbcs
- jbcs-httpd24-httpd jboss core services 1 2.4.57-9.el7jbcs
- jbcs-httpd24-httpd jboss core services 1 2.4.57-9.el8jbcs
- jbcs-httpd24-libcurl jboss core services 1 8.6.0-3.el7jbcs
- jbcs-httpd24-libcurl jboss core services 1 8.6.0-3.el8jbcs
- jbcs-httpd24-mod_ssl jboss core services 1 1:2.4.57-9.el7jbcs
- jbcs-httpd24-mod_ssl jboss core services 1 1:2.4.57-9.el8jbcs
red hat advisories RHSA-2024:0428RHSA-2024:1316RHSA-2024:1601RHSA-2024:0452RHSA-2024:1129RHSA-2024:0434
- curl SLE Micro 5.2, SLE Micro 5.1 7.66.0-150200.4.63.1
- curl SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, SLE Micro 5.5 +6 more 8.0.1-150400.5.36.1
- curl SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 8.0.1-11.80.1
- curl SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 7.60.0-150000.56.1
suse advisories SUSE-SU-2023:4713-1SUSE-SU-2023:4659-1SUSE-SU-2023:4653-1SUSE-SU-2023:4650-1
- curl openSUSE Tumbleweed 8.5.0-1.1
opensuse advisories openSUSE-SU-2024:13509-1
- curl AlmaLinux 8 7.61.1-33.el8_9.5
- libcurl AlmaLinux 8 7.61.1-33.el8_9.5
- libcurl-minimal AlmaLinux 8 7.61.1-33.el8_9.5
- curl AlmaLinux 9 7.76.1-26.el9_3.3
- libcurl AlmaLinux 9 7.76.1-26.el9_3.3
- curl-minimal AlmaLinux 9 7.76.1-26.el9_3.3
- libcurl-minimal AlmaLinux 9 7.76.1-26.el9_3.3
almalinux advisories ALSA-2024:1601ALSA-2024:1129
- curl Rocky Linux 8 7.61.1-33.el8_9.5
rocky linux advisories RLSA-2024:1601
- curl Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 8.5.0-r0
alpine advisories ALPINE-CVE-2023-46218
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- curl CBL-Mariner 2.0 8.5.0-1
- cmake CBL-Mariner 2.0 3.21.4-13
- mysql CBL-Mariner 2.0 8.0.35-2
- cmake Azure Linux 3.0 3.29.6-1
- mysql Azure Linux 3.0 8.0.40-1
azure linux advisories AZL-32099AZL-32119AZL-32126AZL-34618AZL-35019
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- hackerone.com/reports/2212193 advisory
- curl.se/docs/CVE-2023-46218.html advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-46218 updated cvss 5.3
curl: information disclosure by exploiting a mixed case flaw
-
Red Hat Satellite 6 puppet-agentaffected: no fix available
-
Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel 7.76.1-26.el9_3.3, curl-debuginfo 7.76.1-26.el9_3.3, curl-debugsource 7.76.1-26.el9_3.3, libcurl-debuginfo 7.76.1-26.el9_3.3, curl-minimal-debuginfo 7.76.1-26.el9_3.3, libcurl-minimal-debuginfo 7.76.1-26.el9_3.3fixed: vendor fix RHSA-2024:1129
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) libcurl-devel 7.76.1-14.el9_0.11, curl-debuginfo 7.76.1-14.el9_0.11, curl-debugsource 7.76.1-14.el9_0.11, libcurl-debuginfo 7.76.1-14.el9_0.11, curl-minimal-debuginfo 7.76.1-14.el9_0.11, libcurl-minimal-debuginfo 7.76.1-14.el9_0.11fixed: vendor fix RHSA-2024:0434
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) libcurl-devel 7.76.1-23.el9_2.6, curl-debuginfo 7.76.1-23.el9_2.6, curl-debugsource 7.76.1-23.el9_2.6, libcurl-debuginfo 7.76.1-23.el9_2.6, curl-minimal-debuginfo 7.76.1-23.el9_2.6, libcurl-minimal-debuginfo 7.76.1-23.el9_2.6fixed: vendor fix RHSA-2024:0452
-
Red Hat Enterprise Linux BaseOS (v. 8) curl 7.61.1-33.el8_9.5, libcurl 7.61.1-33.el8_9.5, libcurl-minimal 7.61.1-33.el8_9.5fixed: vendor fix RHSA-2024:1601
-
Red Hat Enterprise Linux BaseOS (v. 9) curl 7.76.1-26.el9_3.3, libcurl 7.76.1-26.el9_3.3, curl-minimal 7.76.1-26.el9_3.3, libcurl-minimal 7.76.1-26.el9_3.3fixed: vendor fix RHSA-2024:1129
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) curl 7.61.1-22.el8_6.12, libcurl 7.61.1-22.el8_6.12, libcurl-minimal 7.61.1-22.el8_6.12fixed: vendor fix RHSA-2024:0428
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) curl 7.61.1-30.el8_8.9, libcurl 7.61.1-30.el8_8.9, libcurl-minimal 7.61.1-30.el8_8.9fixed: vendor fix RHSA-2024:0585
show 9 moreshow fewer
-
Red Hat Enterprise Linux BaseOS EUS (v.9.0) curl 7.76.1-14.el9_0.11, libcurl 7.76.1-14.el9_0.11, curl-minimal 7.76.1-14.el9_0.11, libcurl-minimal 7.76.1-14.el9_0.11fixed: vendor fix RHSA-2024:0434
-
Red Hat Enterprise Linux BaseOS EUS (v.9.2) curl 7.76.1-23.el9_2.6, libcurl 7.76.1-23.el9_2.6, curl-minimal 7.76.1-23.el9_2.6, libcurl-minimal 7.76.1-23.el9_2.6fixed: vendor fix RHSA-2024:0452
-
Red Hat JBoss Core Servicesfixed: vendor fix RHSA-2024:1317
-
Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl 8.6.0-3.el7jbcs, jbcs-httpd24-libcurl 8.6.0-3.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl 8.6.0-3.el8jbcs, jbcs-httpd24-libcurl 8.6.0-3.el8jbcsfixed: vendor fix RHSA-2024:1316
-
Red Hat RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9 v4.15.0-37, odf4/odf-cli-rhel9 v4.15.0-22, odf4/mcg-core-rhel9 v4.15.0-68, odf4/odf-console-rhel9 v4.15.0-57, odf4/mcg-rhel9-operator v4.15.0-39, odf4/ocs-rhel9-operator v4.15.0-79, +20 morefixed: vendor fix RHSA-2024:1383
-
Red Hat RHOL 5.6 for RHEL 8 openshift-logging/kibana6-rhel8 v6.8.1-430, openshift-logging/vector-rhel8 v0.21.0-127, openshift-logging/fluentd-rhel8 v1.14.6-216, openshift-logging/eventrouter-rhel8 v0.4.0-246, openshift-logging/logging-loki-rhel8 v2.9.6-16, openshift-logging/loki-rhel8-operator v5.6.18-12, +12 morefixed: vendor fix RHSA-2024:2092
-
Red Hat RHOL 5.7 for RHEL 8 openshift-logging/vector-rhel8 v0.28.1-57, openshift-logging/kibana6-rhel8 v6.8.1-431, openshift-logging/fluentd-rhel8 v1.14.6-215, openshift-logging/eventrouter-rhel8 v0.4.0-248, openshift-logging/logging-loki-rhel8 v2.9.6-15, openshift-logging/loki-rhel8-operator v5.7.13-12, +12 morefixed: vendor fix RHSA-2024:2093
-
Red Hat RHOL 5.8 for RHEL 9 openshift-logging/fluentd-rhel9 v5.8.6-5, openshift-logging/vector-rhel9 v0.28.1-56, openshift-logging/eventrouter-rhel9 v0.4.0-247, openshift-logging/logging-loki-rhel9 v2.9.6-14, openshift-logging/loki-rhel9-operator v5.8.6-10, openshift-logging/loki-operator-bundle v5.8.6-24, +11 morefixed: vendor fix RHSA-2024:2094
-
Red Hat Enterprise Linux 6 curl, libcurl Red Hat Enterprise Linux 7 curl, libcurl Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd 2.4.57-9.el7jbcs, jbcs-httpd24-mod_md 2.4.24-4.el7jbcs, jbcs-httpd24-mod_ssl 2.4.57-9.el7jbcs, jbcs-httpd24-mod_ldap 2.4.57-9.el7jbcs, jbcs-httpd24-openssl 1.1.1k-17.el7jbcs, jbcs-httpd24-apr-util 1.6.1-104.el7jbcs, +21 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-httpd 2.4.57-9.el8jbcs, jbcs-httpd24-mod_md 2.4.24-4.el8jbcs, jbcs-httpd24-mod_ssl 2.4.57-9.el8jbcs, jbcs-httpd24-mod_ldap 2.4.57-9.el8jbcs, jbcs-httpd24-openssl 1.1.1k-17.el8jbcs, jbcs-httpd24-apr-util 1.6.1-104.el8jbcs, +21 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-25-162-05 updated cvss 6.5
Siemens SIMATIC S7-1500 CPU family
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-319-04 updated cvss 6.5
Siemens SINEC NMS
-
Siemens SINEC NMS <V3.0_SP1affected: fixed in V3.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-137-07 updated cvss 6.5
Siemens SIMATIC RTLS Locating Manager
-
Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA00) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA10) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA20) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA30) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-1EA10) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-1EA20) <V3.0.1.1affected: fixed in V3.0.1.1, mitigation
+1 more productsfewer
Siemens SIMATIC RTLS Locating Manager (6GT2780-1EA30) <V3.0.1.1
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
1.69% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- hackerone.com https://hackerone.com/reports/2212193 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | CURL_jll | <8.5.0+0 |
8.5.0+0 |
| julia | LibCURL_jll | <8.5.0+0 |
8.5.0+0 |
Affected products
- curl curl
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
- Siemens RUGGEDCOM ROX MX5000
- Siemens RUGGEDCOM ROX MX5000RE
- Siemens RUGGEDCOM ROX RX1400
- Siemens RUGGEDCOM ROX RX1500
- Siemens RUGGEDCOM ROX RX1501
- Siemens RUGGEDCOM ROX RX1510
- Siemens RUGGEDCOM ROX RX1511
- Siemens RUGGEDCOM ROX RX1512
- Siemens RUGGEDCOM ROX RX1524
- Siemens RUGGEDCOM ROX RX1536
- Siemens RUGGEDCOM ROX RX5000
- Siemens SINEC NMS
Classification
- Weakness
-
- CWE-178 Improper Handling of Case Sensitivity
References
-
hackerone.com
/reports/2212193
exploit, issue-tracking, patch, third-party-advisory, web
-
curl.se
/docs/CVE-2023-46218.html
patch, vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/
mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
web
-
lists.debian.org
/debian-lts-announce/2023/12/msg00015.html
web
-
debian.org
/security/2023/dsa-5587
web
-
security.netapp.com
/advisory/ntap-20240125-0007/
web
-
cert-portal.siemens.com
/productcert/html/ssa-093430.html
web
-
cert-portal.siemens.com
/productcert/html/ssa-331112.html
web
-
cert-portal.siemens.com
/productcert/html/ssa-082556.html
web
-
cert-portal.siemens.com
/productcert/html/ssa-202008.html
web
-
github.com
/advisories/GHSA-59mm-6rr4-j9p2
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-46218
web
-
security.netapp.com
/advisory/ntap-20240125-0007
web
Sources
- CVE List CVE-2023-46218
- NVD CVE-2023-46218
- OSV JLSEC-2026-411
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Improve version ranges to indicate fix.