CyberRota Analysis
AI-GeneratedA vulnerability in libcurl allows an HTTP connection established with Negotiate authentication to be improperly reused when the initial request is made with empty credentials. This could lead to user B's requests being inadvertently sent over user A's authenticated session, potentially exposing sensitive data or allowing unauthorized actions. Organizations utilizing libcurl for HTTP connections, particularly in environments where Negotiate authentication is implemented, should prioritize addressing this issue to mitigate the risk of credential leakage and session hijacking.
Original NVD Description
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Related CVEs
Other vulnerabilities affecting the same vendor(s)