An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).
https://hackerone.com/reports/1526328
https://security.netapp.com/advisory/ntap-20220609-0008/
https://www.debian.org/security/2022/dsa-5197
https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
Source: MITRE
Published: 2022-05-26
Updated: 2023-01-05
Type: CWE-287
Base Score: 5.5
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Impact Score: 4.9
Exploitability Score: 8
Severity: MEDIUM
Base Score: 8.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Impact Score: 5.2
Exploitability Score: 2.8
Severity: HIGH