Cyber Resilience

CVE-2024-11053

LowPublic PoC

Published: 11 December 2024

Published
11 December 2024
Modified
03 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0129 80.0th percentile
Risk Priority 8 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-11053 is a low-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 3.4 (Low).

Operationally, ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc…

more

file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

CWE(s)
NVD-CWE-noinfo

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

haxx
curl
7.76.0 — 8.11.1
netapp
ontap
9
netapp
ontap select deploy administration utility
all versions
netapp
h610c firmware
all versions
netapp
h610s firmware
all versions
netapp
h615c firmware
all versions
netapp
h700s firmware
all versions
netapp
bootstrap os
all versions
netapp
h300s firmware
all versions
netapp
h410s firmware
all versions
+1 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References