Lucene search

K

[email protected]NVD:CVE-2021-22923

HistoryAug 05, 2021 - 9:15 p.m.

CVE-2021-22923

2021-08-0521:15:11

CWE-319

CWE-522

[email protected]

web.nvd.nist.gov

1

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

56.7%

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user’s expectations and intentions and without telling the user it happened.

Affected configurations

NVD

Node

haxxcurlRange7.27.0–7.78.0

Node

fedoraprojectfedoraMatch33

Node

netappcloud_backupMatch-

OR

netappclustered_data_ontapMatch-

OR

netapphci_management_nodeMatch-

OR

netappsolidfireMatch-

Node

oraclemysql_serverRange5.7.0–5.7.35

OR

oraclemysql_serverRange8.0.0–8.0.26

Node

siemenssinec_infrastructure_network_servicesRange<1.0.1.1

Node

netapph300s_firmwareMatch-

AND

netapph300sMatch-

Node

netapph500s_firmwareMatch-

AND

netapph500sMatch-

Node

netapph700s_firmwareMatch-

AND

netapph700sMatch-

Node

netapph300e_firmwareMatch-

AND

netapph300eMatch-

Node

netapph500e_firmwareMatch-

AND

netapph500eMatch-

Node

netapph700e_firmwareMatch-

AND

netapph700eMatch-

Node

netapph410s_firmwareMatch-

AND

netapph410sMatch-

Node

splunkuniversal_forwarderRange8.2.0–8.2.12

OR

splunkuniversal_forwarderRange9.0.0–9.0.6

OR

splunkuniversal_forwarderMatch9.1.0

References

cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

hackerone.com/reports/1213181

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/

security.gentoo.org/glsa/202212-01

security.netapp.com/advisory/ntap-20210902-0003/

www.oracle.com/security-alerts/cpuoct2021.html

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

56.7%

Related for NVD:CVE-2021-22923