Severity
5.3MEDIUM
EPSS
0.1%
top 74.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 5
Latest updateMay 24

Description

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages6 packages

NVDhaxx/curl7.27.07.78.0
Debiancurl< 7.79.1-1+2
CVEListV5https://github.com/curl/curlcurl 7.27.0 to and including 7.77.0
NVDsplunk/universal_forwarder8.2.08.2.12+2

Also affects: Fedora 33

Patches

🔴Vulnerability Details

3
GHSA
GHSA-89qw-6g6w-269q: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same2022-05-24
OSV
CVE-2021-22923: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same2021-08-05
CVEList
CVE-2021-22923: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same2021-08-05

📋Vendor Advisories

3
Microsoft
When curl is instructed to get content using the metalink feature and a user name and password are used to download the metalink XML file those same credentials are then subsequently passed on to each2021-08-10
Red Hat
curl: Metalink download sends credentials2021-07-21
Debian
CVE-2021-22923: curl - When curl is instructed to get content using the metalink feature, and a user na...2021

💬Community

1
HackerOne
CVE-2021-22923: Metalink download sends credentials2021-07-21