CVE-2021-22923
Severity
5.3MEDIUM
EPSS
0.1%
top 74.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 5
Latest updateMay 24
Description
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6
Affected Packages6 packages
Also affects: Fedora 33
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-89qw-6g6w-269q: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same↗2022-05-24
OSV▶
CVE-2021-22923: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same↗2021-08-05
CVEList▶
CVE-2021-22923: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same↗2021-08-05
📋Vendor Advisories
3Microsoft▶
When curl is instructed to get content using the metalink feature and a user name and password are used to download the metalink XML file those same credentials are then subsequently passed on to each↗2021-08-10
Debian▶
CVE-2021-22923: curl - When curl is instructed to get content using the metalink feature, and a user na...↗2021