CVE-2021-22923

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319 CWE-522

Affected software

Vendor	Product	Versions
n/a	https://github.com/curl/curl	curl 7.27.0 to and including 7.77.0
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
https://hackerone.com/reports/1213181Exploit, Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202212-01Third Party Advisory
https://security.netapp.com/advisory/ntap-20210902-0003/Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
https://hackerone.com/reports/1213181Exploit, Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202212-01Third Party Advisory
https://security.netapp.com/advisory/ntap-20210902-0003/Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-389290.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline

Published: Aug 5, 2021
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-229243.7libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to err CVE-2021-229255.3curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=con CVE-2021-229267.5libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` optio CVE-2021-229278.1A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow a CVE-2021-229287.8A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has eit CVE-2021-229296.1An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps o CVE-2021-22934.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.CVE-2021-229309.8Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c CVE-2021-229319.8Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation CVE-2021-229327.5An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file CVE-2021-229336.5A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a m CVE-2021-229347.2A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device