CVE-2021-22876
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD
Description
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
Affected (16)
Products: Haxx: Libcurl · Fedoraproject: Fedora · Netapp: Hci Compute Node, Hci Management Node, Hci Storage Node, Solidfire · +5 more
Show all products
Haxx: Libcurl · Fedoraproject: Fedora · Netapp: Hci Compute Node, Hci Management Node, Hci Storage Node, Solidfire · Broadcom: Fabric Operating System · Debian: Debian Linux · Siemens: Sinec Infrastructure Network Services · Oracle: Communications Billing And Revenue Management, Essbase · Splunk: Universal Forwarder
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 32 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| All versions | |
| All versions | |
| All versions | |
| All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Version 9.0 |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| version < 1.0.1.1 |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| Version 12.0.0.3.0 | |
| Version 21.2 |
Configuration H
| Vulnerable Software | Affected Versions |
|---|---|
| 8.2.0 ≤ version < 8.2.12 |
Related CWEs
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
References (22)
Source: support@hackerone.com
PatchThird Party Advisory
Source: support@hackerone.com
ExploitIssue TrackingPatchThird Party Advisory
Source: support@hackerone.com
Mailing ListThird Party Advisory
Source: support@hackerone.com
Mailing ListThird Party Advisory
Source: support@hackerone.com
Mailing ListThird Party Advisory
Source: support@hackerone.com
Mailing ListThird Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Timeline
No history available yet.