CVE-2023-46218

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.

It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-178

Affected software

VendorProductVersions
curlcurl>= 8.4.0, <= 8.4.0
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensRUGGEDCOM ROX MX5000< V2.17.0
SiemensRUGGEDCOM ROX MX5000RE< V2.17.0
SiemensRUGGEDCOM ROX RX1400< V2.17.0
SiemensRUGGEDCOM ROX RX1500< V2.17.0
SiemensRUGGEDCOM ROX RX1501< V2.17.0
SiemensRUGGEDCOM ROX RX1510< V2.17.0
SiemensRUGGEDCOM ROX RX1511< V2.17.0
SiemensRUGGEDCOM ROX RX1512< V2.17.0
SiemensRUGGEDCOM ROX RX1524< V2.17.0
SiemensRUGGEDCOM ROX RX1536< V2.17.0
SiemensRUGGEDCOM ROX RX5000< V2.17.0
SiemensSINEC NMS< V3.0 SP1

References

Timeline

Published
Dec 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-462195.3When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file CVE-2023-46227.0A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_sCVE-2023-462209.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462219.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462229.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462239.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462249.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462259.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofCVE-2023-462269.8Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgCVE-2023-462277.5Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 tCVE-2023-462287.8zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, CVE-2023-462298.8LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an
CVE-2023-46218: Medium severity, CVSS 6.5 | Vulnix