New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 3.6
Synopsis
The remote device is missing a vendor-supplied security patch.
Description
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.(CVE-2016-8615)
Impact
When a cURL connection stores a cookie state and is written into a cookie jar file that is later used for the subsequent cURL requests, a malicious web server can inject new cookies into the affected cookie jar for arbitrary domains. This exploit requires access to a malicious web server that serves cookies.
Solution
Upgrade to one of the non-vulnerable versions listed in the F5 Solution K01006862.