Medium severity · published Apr 1, 2021
CVE-2021-22876
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header
5.3
CVSS
5.3%
EPSS
No
On KEV
Description
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
https://github.com/curl/curl ·
7.1.1 to and including 7.75.0 · source: vendor
CB
Communications Billing And Revenue Management · Oracle
12.0.0.3.0 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
ES
Essbase · Oracle
21.2 · source: NVD
FO
Fabric Operating System · Broadcom
All versions, or not specified · source: NVD
FE
Fedora · Fedoraproject
32; 33; 34 · source: NVD
HC
Hci Compute Node · Netapp
All versions, or not specified · source: NVD
HM
Hci Management Node · Netapp
All versions, or not specified · source: NVD
HS
Hci Storage Node · Netapp
All versions, or not specified · source: NVD
LI
Libcurl · Haxx
7.1.1 through 7.75.0 · source: NVD
SI
Sinec Infrastructure Network Services · Siemens
before 1.0.1.1 · source: NVD
SO
Solidfire · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22876
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22876
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
https://curl.se/docs/CVE-2021-22876.html
Exploit
https://hackerone.com/reports/1101882
Mailing List
https://lists.debian.org/debian-lts-announce/2021/05/msg00019.html
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/
More from https://github.com/curl/curl
9.8
CVE-2022-32221
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been…
9.8
CVE-2022-32207
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final…
9.1
CVE-2023-23914
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially
9.1
CVE-2021-22945
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in…
8.8
CVE-2023-27534
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in…