CVE-2021-22876

moderate-risk

Published 2021-04-01

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Do I need to act?

0.11% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Affected Products (15)

Libcurl

Fedora

Hci Management Node

Solidfire

Hci Compute Node

Hci Storage Node

Fabric Operating System

Debian Linux

Sinec Infrastructure Network Services

Communications Billing And Revenue Management

Essbase

Universal Forwarder

Affected Vendors

Debian Oracle Siemens Broadcom Haxx Fedoraproject Netapp Splunk

References (20)

Patch https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Patch https://curl.se/docs/CVE-2021-22876.html

Exploit https://hackerone.com/reports/1101882

Mailing List https://lists.debian.org/debian-lts-announce/2021/05/msg00019.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202105-36

Third Party Advisory https://security.netapp.com/advisory/ntap-20210521-0007/

Third Party Advisory https://www.oracle.com//security-alerts/cpujul2021.html

Patch https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Patch https://curl.se/docs/CVE-2021-22876.html

Exploit https://hackerone.com/reports/1101882

Mailing List https://lists.debian.org/debian-lts-announce/2021/05/msg00019.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202105-36

Third Party Advisory https://security.netapp.com/advisory/ntap-20210521-0007/

Third Party Advisory https://www.oracle.com//security-alerts/cpujul2021.html

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 18/34 · Moderate