Published: 05/08/2021 Updated: 27/03/2024

CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9

CVSS v3 Base Score: 5.3 | Impact Score: 3.6 | Exploitability Score: 1.6

VMScore: 232

Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl
fedoraproject fedora 33
netapp cloud backup -
netapp clustered data ontap -
netapp solidfire -
netapp hci management node -
oracle mysql server
siemens sinec infrastructure network services
netapp h300s_firmware -
netapp h500s_firmware -
netapp h700s_firmware -
netapp h300e_firmware -
netapp h500e_firmware -
netapp h700e_firmware -
netapp h410s_firmware -
splunk universal forwarder 9.1.0
splunk universal forwarder

A flaw was found in the way curl handled telnet protocol option for sending environment variables, which could lead to sending of uninitialized data from a stack-based buffer to the server This issue leads to potentially revealing sensitive internal information to the server using a clear-text network protocol (CVE-2021-22898) A flaw was found in ...

A flaw was found in curl in the way curl handles credentials when downloading content using the Metalink feature This flaw allows malicious actors controlling a hosting server to gain access to credentials provided while downloading content without the user's knowledge The highest threat from this vulnerability is to confidentiality ...

A security issue has been found in curl before version 7780 When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from; of ...

Critical Infrastructure Sectors: Critical Manufacturing

Critical Infrastructure Sectors: Energy

CWE-319 CWE-522 https://hackerone.com/reports/1213181 https://security.netapp.com/advisory/ntap-20210902-0003/https://www.oracle.com/security-alerts/cpuoct2021.html https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://security.gentoo.org/glsa/202212-01 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2021-1700.html https://www.cisa.gov/uscert/ics/advisories/icsa-22-069-09 https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10

CVE-2021-22923

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect