CVE-2021-22923
- State
- Published
- Severity
- Not scored
- Published
- Aug 5, 2021
- Updated
- Oct 14, 2026
- Reserved
- Jan 6, 2021
Description
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
Scores
The record has no CVSS score.
Weaknesses
- CWE-319 Cleartext Transmission of Sensitive Information (CWE-319)
Affected Products
| Product | Versions |
|---|---|
https://github.com/curl/curln/a |
|
References
- https://hackerone.com/reports/1213181
- FEDORA-2021-5d21b90a30vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210902-0003/
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- GLSA-202212-01vendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.