Vulnerability Details : CVE-2021-22923

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
Publish Date : 2021-08-05 Last Update Date : 2023-01-05

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	2.6
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	None (There is no impact to the integrity of the system)
Availability Impact	None (There is no impact to the availability of the system.)
Access Complexity	High (Specialized access conditions exist. It is hard to exploit and several special conditions must be satisfied to exploit)
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)
CWE ID	522

- Related OVAL Definitions

Title	Definition Id	Class	Family
RHSA-2021:3582: curl security update (Moderate)	oval:com.redhat.rhsa:def:20213582		unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2021-22923

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	OS	Fedoraproject	Fedora	33	*	*	*	Version Details Vulnerabilities
2	Application	Haxx	Curl	*	*	*	*	Version Details Vulnerabilities
3	Application	Netapp	Cloud Backup	-	*	*	*	Version Details Vulnerabilities
4	Application	Netapp	Clustered Data Ontap	-	*	*	*	Version Details Vulnerabilities
5	Application	Netapp	Hci Management Node	-	*	*	*	Version Details Vulnerabilities
6	Application	Netapp	Solidfire	-	*	*	*	Version Details Vulnerabilities
7	Application	Oracle	Mysql Server	*	*	*	*	Version Details Vulnerabilities
8	Application	Siemens	Sinec Infrastructure Network Services	*	*	*	*	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Fedoraproject	Fedora	1
Haxx	Curl	1
Netapp	Cloud Backup	1
Netapp	Clustered Data Ontap	1
Netapp	Hci Management Node	1
Netapp	Solidfire	1
Oracle	Mysql Server	1
Siemens	Sinec Infrastructure Network Services	1

- References For CVE-2021-22923

https://hackerone.com/reports/1213181

https://security.gentoo.org/glsa/202212-01
GENTOO GLSA-202212-01

https://security.netapp.com/advisory/ntap-20210902-0003/ CONFIRM

https://lists.fedoraproject.org/archives/list/[email protected]/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
FEDORA FEDORA-2021-5d21b90a30

https://www.oracle.com/security-alerts/cpuoct2021.html

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf CONFIRM

- Vulnerability Conditions

Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Cloud Backup * * * Fedoraproject Fedora 33 * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *

- Metasploit Modules Related To CVE-2021-22923

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)