CVEvulnerability

CVE-2021-22923

5.3 MEDIUM Published 2021-08-05 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2021-08-05
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
Weaknesses
CWE-319, CWE-522

Description

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Affected configurations

• haxx curl (>= 7.27.0 < 7.78.0) • fedoraproject fedora 33 • netapp cloud backup • netapp clustered data ontap • netapp hci management node • netapp solidfire • oracle mysql server (>= 5.7.0 <= 5.7.35) • oracle mysql server (>= 8.0.0 <= 8.0.26) • siemens sinec infrastructure network services (< 1.0.1.1) • netapp h300s firmware • netapp h500s firmware • netapp h700s firmware • netapp h300e firmware • netapp h500e firmware • netapp h700e firmware • netapp h410s firmware • splunk universal forwarder (>= 8.2.0 < 8.2.12) • splunk universal forwarder (>= 9.0.0 < 9.0.6) • splunk universal forwarder 9.1.0

Related

Weakness · CWE (2)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References