CVE-2022-42916

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

VendorProductVersions
n/an/an/a
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5

References

Timeline

Published
Oct 29, 2022
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-429176.7In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/CVE-2022-429197.8Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python muCVE-2022-42927.8Use After Free in GitHub repository vim/vim prior to 9.0.0882.CVE-2022-429209.8Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bCVE-2022-429238.8Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could alloCVE-2022-429246.5Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could alloCVE-2022-429258.8There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to priCVE-2022-429278.1A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.CVE-2022-429288.8Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corrCVE-2022-429296.5If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browseCVE-2022-42935.5Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.CVE-2022-429307.1If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This
CVE-2022-42916: High severity, CVSS 7.5 | Vulnix