CVE-2021-22876: broadcom fabric_operating_system

Vulnerability summary

CVE-2021-22876 is a medium (CVSS 5.3) vulnerability in broadcom fabric_operating_system. EPSS estimates a 5.30% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-04-2021
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

• CWE-359Exposure of Private Personal Information to an Unauthorized ActorThe product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.