NetSight
IP …
medium5.3

CVE-2021-22876

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP R…

Impact

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Affected products

VendorProductAffected versions
HaxxLibcurl
from 7.1.1 through 7.75.0
FedoraprojectFedora
Versions 32, 33, 34
NetappHci Management Node
All versions
NetappSolidfire
All versions
NetappHci Compute Node
All versions
NetappHci Storage Node
All versions
BroadcomFabric Operating System
All versions
DebianDebian Linux
Version 9.0
SiemensSinec Infrastructure Network Services
before 1.0.1.1
OracleCommunications Billing And Revenue Management
Version 12.0.0.3.0
OracleEssbase
Version 21.2
SplunkUniversal Forwarder
from 8.2.0 before 8.2.12
from 9.0.0 before 9.0.6
Version 9.1.0

Weakness classification

CWE-359CWE-200

References