CVE-2021-22946

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-325CWE-319

Affected software

VendorProductVersions
n/ahttps://github.com/curl/curlcurl 7.20.0 to and including 7.78.0
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5

References

Timeline

Published
Sep 29, 2021
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-229475.9When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server CVE-2021-229487.1Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. UnCVE-2021-229495.4A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of dCVE-2021-22958.1Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versioCVE-2021-229506.5Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for dCVE-2021-229517.5Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.CVE-2021-229528.8A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to CVE-2021-229535.4A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of diskCVE-2021-229548.8A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other usersCVE-2021-229557.5A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (GatCVE-2021-229567.5An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attackerCVE-2021-229578.8A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor
CVE-2021-22946: High severity, CVSS 7.5 | Vulnix