Log in Start free

Vulnerability · Published Apr 1, 2021 · Assigned by hackerone

CVE-2021-22876

Medium 5.3

In plain English

A medium-severity security flaw in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.3% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)5.3%top 7.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8curl7.61.1-22.el8ALSA-2021:4511
AlmaLinux:8libcurl7.61.1-22.el8ALSA-2021:4511
AlmaLinux:8libcurl-devel7.61.1-22.el8ALSA-2021:4511
AlmaLinux:8libcurl-minimal7.61.1-22.el8ALSA-2021:4511
Alpine:v3.20curl7.76.0-r0ALPINE-CVE-2021-22876
Alpine:v3.21curl7.76.0-r0ALPINE-CVE-2021-22876
Alpine:v3.22curl7.76.0-r0ALPINE-CVE-2021-22876
Alpine:v3.23curl7.76.0-r0ALPINE-CVE-2021-22876
Alpine:v3.24curl7.76.0-r0ALPINE-CVE-2021-22876
Debian:12curl7.74.0-1.2DEBIAN-CVE-2021-22876
Debian:13curl7.74.0-1.2DEBIAN-CVE-2021-22876
Debian:14curl7.74.0-1.2DEBIAN-CVE-2021-22876
Rocky Linux:8curl0:7.61.1-22.el8RLSA-2021:4511

Affected products (as reported)

VendorProductVersions
n/a https://github.com/curl/curl 7.1.1 to and including 7.75.0

Weakness: CWE-359 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References