CVE-2021-22876

2021-04-0117:45:18

CWE-359

hackerone

www.cve.org

6 Medium

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

83.1%

JSON

curl 7.1.1 to and including 7.75.0 is vulnerable to an “Exposure of Private Personal Information to an Unauthorized Actor” by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

CNA Affected

[
  {
    "product": "https://github.com/curl/curl",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "7.1.1 to and including 7.75.0"
      }
    ]
  }
]