Medium severity · published Apr 29, 2021
CVE-2021-31879
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007
6.1
CVSS
1.1%
EPSS
No
On KEV
Description
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
5F
500f Firmware · Netapp
All versions, or not specified · source: NVD
AF
A250 Firmware · Netapp
All versions, or not specified · source: NVD
BF
Brocade Fabric Operating System Firmware · Broadcom
All versions, or not specified · source: NVD
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
WG
Wget · Gnu
through 1.21.1 · source: NVD
Affected product
BF
Brocade Fabric Operating System Firmware
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-31879
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-31879
Mailing List
https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210618-0002/
More from Brocade Fabric Operating System Firmware
9.0
CVE-2021-40438
mod_proxy SSRF
8.8
CVE-2023-27534
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in…
7.8
CVE-2021-4197
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process…
7.5
CVE-2021-36160
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS)
7.5
CVE-2021-34798
Malformed requests may cause the server to dereference a NULL pointer