Curl is a command-line tool used to transfer data between systems using protocols such as HTTP and HTTPS. It is commonly used by applications and scripts to communicate with web servers and APIs. Curl is included with Windows and is maintained by Microsoft through Windows cumulative updates. ManageEngine vulnerability management solutions detect vulnerabilities in the Curl versions installed on your Windows endpoints.

How are Curl vulnerabilities detected?

During a vulnerability scan, we check the installed Curl version against known vulnerabilities. If the installed version is affected, the corresponding vulnerability is reported.

Windows can have Curl available in both of these locations:

• C:\Windows\System32\curl.exe – x64
• C:\Windows\SysWOW64\curl.exe – x86

Both Curl instances are checked separately to identify whether they are affected by a known vulnerability.

How are Curl vulnerabilities shown in the console?

Curl vulnerabilities are represented differently in the Detailed view and Summary view.

Let's take "Vulnerabilities CVE-2024-11053 are fixed in Curl For Windows 8.11.1", which affects Curl version 8.11.0, as an example.

Suppose a system has the affected Curl version in both locations:

C:\Windows\System32\curl.exe → Version 8.11.0
C:\Windows\SysWOW64\curl.exe → Version 8.11.0

Summary view (Network level)

In the Summary view, vulnerabilities are consolidated based on unique vulnerabilities detected in the network.

Since both Curl instances in our example are affected by the same vulnerability, it will have only one occurrence in the Summary view.

The Affected Systems count will show the total number of systems in your network affected by that CVE. By clicking on the systems count, you will be redirected to the detailed view for these affected systems.

Detailed view (System level)

In the Detailed view, each affected Curl instance is shown separately based on its file path.

In the above example, the  above vulnerability will have two occurrences on the system:

• One for C:\Windows\System32\curl.exe
• One for C:\Windows\SysWOW64\curl.exe


For example, if 100 systems are affected by the mentioned vulnerability:

• Summary view: The vulnerability appears only once, with 100 affected systems.
  
• Detailed view: Each affected Curl instance is shown separately based on its path.
  

In simple terms, the Detailed view tells you exactly where the vulnerability is present, while the Summary view gives you a consolidated picture of the vulnerability and the number of systems affected.

How are Curl vulnerabilities patched?

Since Curl is included and maintained as part of Windows, Microsoft delivers fixes for Windows-provided Curl through Windows cumulative updates rather than separate Curl patches.

When the cummulative update is released, under patch availability it will be marked as Manual Fix Required, and under Remediation, we will mention what applicable Windows cumulative update you need to deploy. You can deploy the corresponding cumulative update to remediate the Curl vulnerability.

Once the update is installed, the Curl version is checked again during the next vulnerability scan. If the installed version is no longer affected, the vulnerability will be cleared automatically.

What if Microsoft hasn't released a fix yet?

In such cases:

• The vulnerability will be detected and reported.
• Patch availability will be shown as Not Available.
• The remediation information will indicate that a fix is expected through an upcoming Windows cumulative update.
  
• We recommend not attempting to remediate the vulnerability manually. Once Microsoft releases the official fix, the applicable cumulative update can be deployed to safely remediate the vulnerability.
  

Summary

ManageEngine detects vulnerable Curl versions on Windows endpoints and provides visibility at both the system and network levels.

The Detailed view (System level) shows each affected Curl instance separately based on its file path.

The Summary view (Network level) consolidates multiple instances of the same vulnerability into one occurrence and displays the Affected Systems count to show how many systems across your network are impacted.

Since Windows-provided Curl is maintained by Microsoft, remediation is handled through the applicable Windows cumulative update.

Regards, 
The ManageEngine Team