CURL-CVE-2021-22876

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2021-22876.html
Import Source
https://curl.se/docs/CURL-CVE-2021-22876.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2021-22876
Aliases
Published
2021-03-31T08:00:00Z
Modified
2024-06-07T13:53:51Z
Summary
Automatic referer leaks credentials
Details

libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

libcurl automatically sets the Referer: HTTP request header field in outgoing HTTP requests if the CURLOPT_AUTOREFERER option is set. With the curl tool, it is enabled with --referer ";auto".

Database specific 
{
    "CWE": {
        "id": "CWE-359",
        "desc": "Exposure of Private Personal Information to an Unauthorized Actor"
    },
    "award": {
        "amount": "800",
        "currency": "USD"
    },
    "URL": "https://curl.se/docs/CVE-2021-22876.json",
    "package": "curl",
    "severity": "Low",
    "issue": "https://hackerone.com/reports/1101882",
    "www": "https://curl.se/docs/CVE-2021-22876.html",
    "last_affected": "7.75.0"
}
References
Credits
    • Viktor Szakats - FINDER
    • Viktor Szakats - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
7.1.1
Fixed
7.76.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
f30ffef477636dc10a72eb30590a84a0218e5935
Fixed
7214288898f5625a6cc196e22a74232eada7861c

Affected versions

7.*

7.1.1
7.10
7.10.1
7.10.2
7.10.3
7.10.4
7.10.5
7.10.6
7.10.7
7.10.8
7.11.0
7.11.1
7.11.2
7.12.0
7.12.1
7.12.2
7.12.3
7.13.0
7.13.1
7.13.2
7.14.0
7.14.1
7.15.0
7.15.1
7.15.2
7.15.3
7.15.4
7.15.5
7.16.0
7.16.1
7.16.2
7.16.3
7.16.4
7.17.0
7.17.1
7.18.0
7.18.1
7.18.2
7.19.0
7.19.1
7.19.2
7.19.3
7.19.4
7.19.5
7.19.6
7.19.7
7.2
7.2.1
7.20.0
7.20.1
7.21.0
7.21.1
7.21.2
7.21.3
7.21.4
7.21.5
7.21.6
7.21.7
7.22.0
7.23.0
7.23.1
7.24.0
7.25.0
7.26.0
7.27.0
7.28.0
7.28.1
7.29.0
7.3
7.30.0
7.31.0
7.32.0
7.33.0
7.34.0
7.35.0
7.36.0
7.37.0
7.37.1
7.38.0
7.39.0
7.4
7.4.1
7.4.2
7.40.0
7.41.0
7.42.0
7.42.1
7.43.0
7.44.0
7.45.0
7.46.0
7.47.0
7.47.1
7.48.0
7.49.0
7.49.1
7.5
7.5.1
7.5.2
7.50.0
7.50.1
7.50.2
7.50.3
7.51.0
7.52.0
7.52.1
7.53.0
7.53.1
7.54.0
7.54.1
7.55.0
7.55.1
7.56.0
7.56.1
7.57.0
7.58.0
7.59.0
7.6
7.6.1
7.60.0
7.61.0
7.61.1
7.62.0
7.63.0
7.64.0
7.64.1
7.65.0
7.65.1
7.65.2
7.65.3
7.66.0
7.67.0
7.68.0
7.69.0
7.69.1
7.7
7.7.1
7.7.2
7.7.3
7.70.0
7.71.0
7.71.1
7.72.0
7.73.0
7.74.0
7.75.0
7.8
7.8.1
7.9
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8