CVE-2021-22923
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
CVE-2021-22923
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2021-22923
https://github.com/curl/curl
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "n/a",
"product": "https://github.com/curl/curl",
"versions": [
{
"status": "affected",
"version": "curl 7.27.0 to and including 7.77.0"
}
]
}
]- Related CVEs
- CVE-2021-22923
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #21661 · Revision 1
- Added to Heist Feed
- Publisher date