CVE-2022-30115

FAUCET Score

CVE-2022-30115 is a medium-severity vulnerability in curl's HSTS implementation, affecting products like haxx, NetApp, and Splunk. It allows a bypass of HSTS protection, potentially leading to clear-text HTTP communication instead of secure HTTPS, if there's a mismatch in trailing dots in hostnames between the URL and the HSTS cache. With a CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the vulnerability has low impact on confidentiality and no impact on integrity or availability, requiring low privileges and network access. There is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, indicating a low current threat.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 7.82.0, < 7.83.1CPE matchmatch criteria	cpe:2.3:a:haxx:curl::::::::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:o:netapp:hci_bootstrap_os:-:::::::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:::::::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:::::::*

CVSS Data

CVSS version used by this source: 3.1

4.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

2.8

Impact Score

1.4

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.19%

Probability of exploitation in next 30 days

EPSS Percentile

64.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0119 is in the 79th percentile among its peer group of 21,977 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

hikvisionpatch availablevia llm_extracted

microsoftpatch availablevia msrc

Product: 18669-16820Fixed in: 7.84.0-1

microsoftpatch availablevia msrc

Product: 18690-16823Fixed in: 7.83.1-1

microsoftpatch availablevia msrc

Product: cm1 curl 7.84.0-1 on CBL Mariner 1.0Fixed in: 7.84.0-1

microsoftpatch availablevia msrc

Product: cbl2 curl 7.83.1-1 on CBL Mariner 2.0Fixed in: 7.83.1-1

zimbrapatch availablevia llm_extracted

Fixed in: 8.2.12, 9.0.6, 9.1.1

Vendor Advisories (4)

zimbrallm-zimbra-9542faa91a6d6884HIGH

August Third Party Package Updates in Splunk Universal Forwarder

Aug 30, 2023

microsoft2022-Jun/CVE-2022-30115Moderate

Using its HSTS support curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

Jun 14, 2022

redhatCVE-2022-30115Moderate

curl: HSTS bypass via trailing dot

May 11, 2022

hikvisionllm-hikvision-7ae8787cf4dc31e4MEDIUM

HSTS bypass via trailing dot

May 11, 2022

References

hackerone.com / reports/1557449

ExploitThird Party Advisory

security.gentoo.org / glsa/202212-01

Third Party Advisory

security.netapp.com / advisory/ntap-20220609-0009

Third Party Advisory

openwall.com / lists/oss-security/2022/10/26/4

Mailing ListPatchThird Party Advisory

openwall.com / lists/oss-security/2022/12/21/1

Mailing ListThird Party Advisory