CVE-2023-23914

CriticalCVSS 9.1/10Last modified Oct 14, 2026

Description

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Feb 23, 2023
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-239156.5A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorr CVE-2023-239166.5An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algori CVE-2023-239178.8A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any u CVE-2023-239187.5A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experime CVE-2023-239197.5A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL erro CVE-2023-23924.8A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the fi CVE-2023-239204.2An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search a CVE-2023-239216.1The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remot CVE-2023-239226.1The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can CVE-2023-239238.2The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set th CVE-2023-239249.8Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with upperca CVE-2023-239257.5Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match