Security readout for executives and security teams
Plain-English summary
curl could incorrectly reuse an OAuth2-authenticated connection for a later transfer using different credentials. In affected mail or directory-service integrations, this could let one authenticated user’s connection be used as if it belonged to another. The issue is high severity and fixed in curl 7.83.0.
Executive priority
Treat this as a high-priority patching issue where curl supports authenticated mail or LDAP workflows. It is less urgent for systems that do not use the affected SASL OAuth2 protocol paths, but broad curl embedding makes inventory important.
Technical view
CVE-2022-22576 is an improper authentication flaw in curl 7.33.0 through 7.82.0. It affects SASL-enabled SMTP(S), IMAP(S), POP3(S), and openldap-backed LDAP(S) when OAuth2-authenticated connections are reused without verifying credential equivalence for the new transfer.
Likely exposure
Exposure is most likely in applications, appliances, containers, and operating-system packages using affected curl/libcurl versions with OAuth2 SASL authentication for mail or LDAP flows. General curl presence alone is not enough; the vulnerable protocol and authentication pattern matter.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source here confirms active exploitation. The risk is credential-context confusion across reused authenticated connections, requiring prior authenticated access according to the CVSS privileges-required value.
Researcher notes
The key exposure condition is not just version range; it is OAuth2-authenticated connection reuse across SASL-enabled protocols. The supplied evidence identifies the fixed upstream version and downstream advisories, but does not provide proof of exploitation in the wild.
Mitigation direction
- Upgrade curl/libcurl to 7.83.0 or a vendor-fixed package.
- Apply relevant Debian, Gentoo, NetApp, or platform vendor security updates.
- Check embedded products and appliances for bundled vulnerable curl versions.
- If upgrade is blocked, follow vendor guidance for supported compensating controls.
- Prioritize services using OAuth2 SASL with mail or LDAP protocols.
Validation and detection
- Inventory curl and libcurl versions across hosts, containers, and appliances.
- Identify applications using SMTP(S), IMAP(S), POP3(S), or openldap LDAP(S) with OAuth2 SASL.
- Confirm installed packages include the vendor fix or curl 7.83.0 or later.
- Review vendor advisories for product-specific affected versions and fixed releases.
- Check authentication logs for unexpected cross-account mail or LDAP activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-22576 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N2.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://hackerone.com/reports/1526328CVE reference, hackerone
- https://security.netapp.com/advisory/ntap-20220609-0008/CVE reference, hackerone
- DSA-5197CVE reference, hackerone · vendor-advisory
- [debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security updateCVE reference, hackerone · mailing-list
- GLSA-202212-01CVE reference, hackerone · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.