CVE-2021-22923: fedoraproject fedora
Vulnerability summary
CVE-2021-22923 is a medium (CVSS 5.3) vulnerability in fedoraproject fedora. EPSS estimates a 2.00% chance of exploitation in the next 30 days, higher than 80.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 10 · Related 7Timeline
- 05-08-2021PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
2.00%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
+0.11 pp
From 1.89% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Netapp11 products
Alpine1 product
- curl≥ 7.27.0, < 7.79.0-r0 | ≥ 7.27.0, < 7.78.0-r0
Debian1 product
- curl< 7.79.1-1
Fedoraproject1 product
- fedoraEOL33
Haxx1 product
- curl≥ 7.27.0, < 7.78.0
Oracle1 product
- mysql_server≥ 5.7.0, ≤ 5.7.35 | ≥ 8.0.0, ≤ 8.0.26
Siemens1 product
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
8 vendors · 18 products
References
11 links- security.netapp.com/advisory/ntap-20210902-0003/Third Party Advisory
