{"id":"CVE-2019-5443","aliases":["CURL-CVE-2019-5443","EUVD-2019-15030","GHSA-79v3-h2vf-vcg6"],"status":"published","title":"A non-privileged user or program can put code and a config file in a known non-privileged path ...","description":"A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl \u003c= 7.65.1 automatically run the code (as an openssl \"engine\") on invocation. If that curl is invoked by a privileged user it can do anything it wants.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0069,"percentile":0.53054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-427","CWE-94"],"published":"2019-06-24T08:00:00Z","modified":"2026-10-24T23:17:46Z","products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_unified_manager"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"oracle","product":"enterprise_manager_ops_center"},{"vendor":"oracle","product":"http_server"},{"vendor":"oracle","product":"mysql_server"},{"vendor":"oracle","product":"oss_support_tools"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/06/24/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/108881","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://curl.haxx.se/docs/CVE-2019-5443.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20191017-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5443"},{"url":"https://security.netapp.com/advisory/ntap-20191017-0002"},{"url":"https://github.com/advisories/GHSA-79v3-h2vf-vcg6"}],"sources":{"cve":[{"id":"CVE-2019-5443","description":"A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl \u003c= 7.65.1 automatically run the code (as an openssl \"engine\") on invocation. If that curl is invoked by a privileged user it can do anything it wants.","status":"published","published":"2019-07-02T18:31:23Z","modified":"2026-10-14T06:35:43.42Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-15030","description":"A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl \u003c= 7.65.1 automatically run the code (as an openssl \"engine\") on invocation. If that curl is invoked by a privileged user it can do anything it wants.","status":"published","published":"2019-07-02T18:31:23Z","modified":"2026-10-14T06:35:43Z","updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-79v3-h2vf-vcg6","title":"A non-privileged user or program can put code and a config file in a known non-privileged path ...","description":"A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl \u003c= 7.65.1 automatically run the code (as an openssl \"engine\") on invocation. If that curl is invoked by a privileged user it can do anything it wants.","status":"published","published":"2022-05-24T16:49:17Z","modified":"2026-10-14T09:31:22Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-427"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2019-5443","description":"A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl \u003c= 7.65.1 automatically run the code (as an openssl \"engine\") on invocation. If that curl is invoked by a privileged user it can do anything it wants.","status":"published","published":"2019-07-02T19:15:10.79Z","modified":"2026-10-14T07:16:54.88Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94","CWE-427"],"updated_at":"2026-11-02T14:05:17.695191Z"}],"osv":[{"id":"CVE-2019-5443","description":"A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl \u003c= 7.65.1 automatically run the code (as an openssl \"engine\") on invocation. If that curl is invoked by a privileged user it can do anything it wants.","status":"published","published":"2019-07-02T19:15:10.79Z","modified":"2026-10-24T10:30:42.671872136Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"CURL-CVE-2019-5443","title":"Windows OpenSSL engine code injection","description":"A non-privileged user or program can put code and a config file in a known\nnon-privileged path (under `C:/usr/local/`) that makes curl automatically run\nthe code (as an OpenSSL \"engine\") on invocation. If that curl is invoked by a\nprivileged user it can do anything it wants.\n\nThis flaw exists in the official curl-for-windows binaries built and hosted by\nthe curl project (all versions up to and including 7.65.1_1). It **does not**\nexist in the curl executable shipped by Microsoft, bundled with Windows 10. It\npossibly exists in other curl builds for Windows too that uses OpenSSL.\n\nThe curl project has provided official curl executable builds for Windows\nsince [late August\n2018](https://daniel.haxx.se/blog/2018/08/27/blessed-curl-builds-for-windows/).\n\nThere exists proof of concept exploits of this flaw.","status":"published","published":"2019-06-24T08:00:00Z","modified":"2026-10-24T23:17:46Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}