A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
haxx curl |
||
oracle enterprise manager ops center 12.3.3 |
||
oracle enterprise manager ops center 12.4.0 |
||
oracle http server 12.2.1.3.0 |
||
oracle http server 12.2.1.4.0 |
||
oracle mysql server |
||
oracle oss support tools 20.0 |
||
netapp oncommand insight - |
||
netapp oncommand unified manager |
||
netapp oncommand workflow automation - |
||
netapp snapcenter - |
Vulmon