Versio.io

CVE-2021-22923

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 05-08-2021 11:15
Last modified: - 06-04-2022 04:26
Total changes: - 12

Description

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
High
Attack complexity
Network
Attack vector
None
Availability
High
Confidentiality
None
Integrity
None
Privileges required
Unchanged
Scope
Required
User interaction
5.3
Base score
1.6
3.6
Exploitability score
Impact score
 

Verification logic

OR
OR
vendor=haxx AND product=curl AND versionStartIncluding=7.27.0 AND versionEndExcluding=7.78.0
OR
vendor=fedoraproject AND product=fedora AND version=33
OR
vendor=netapp AND product=cloud_backup AND version=-
vendor=netapp AND product=clustered_data_ontap AND version=-
vendor=netapp AND product=hci_management_node AND version=-
vendor=netapp AND product=solidfire AND version=-
OR
vendor=oracle AND product=mysql_server AND versionEndIncluding=5.7.35 AND versionStartIncluding=5.7.0
vendor=oracle AND product=mysql_server AND versionEndIncluding=8.0.26 AND versionStartIncluding=8.0.0
OR
vendor=siemens AND product=sinec_infrastructure_network_services AND versionEndExcluding=1.0.1.1
AND
OR
vendor=netapp AND product=h300s_firmware AND version=-
OR
vendor=netapp AND product=h300s AND version=-
AND
OR
vendor=netapp AND product=h500s_firmware AND version=-
OR
vendor=netapp AND product=h500s AND version=-
AND
OR
vendor=netapp AND product=h700s_firmware AND version=-
OR
vendor=netapp AND product=h700s AND version=-
AND
OR
vendor=netapp AND product=h300e_firmware AND version=-
OR
vendor=netapp AND product=h300e AND version=-
AND
OR
vendor=netapp AND product=h500e_firmware AND version=-
OR
vendor=netapp AND product=h500e AND version=-
AND
OR
vendor=netapp AND product=h700e_firmware AND version=-
OR
vendor=netapp AND product=h700e AND version=-
AND
OR
vendor=netapp AND product=h410s_firmware AND version=-
OR
vendor=netapp AND product=h410s AND version=-
 

Reference

 


Keywords

NVD

 

CVE-2021-22923

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.