---
id: CVE-2021-22923
title: >-
  When curl is instructed to get content using the metalink feature, and a user
  name and password are used to download the metalink XML file, those same
  credentials are then subsequently passed on to each of the servers from which
  curl wil…
summary: >-
  When curl is instructed to get content using the metalink feature, and a user
  name and password are used to download the metalink XML file, those same
  credentials are then subsequently passed on to each of the servers from which
  curl wil…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-319
  - CWE-319
  - CWE-522
vendor: haxx
product: curl
affected:
  - 'curl >= 7.27.0, < 7.78.0'
  - fedora = 33
  - cloud_backup
  - clustered_data_ontap
  - hci_management_node
  - solidfire
  - 'mysql_server >= 5.7.0, <= 5.7.35'
  - 'mysql_server >= 8.0.0, <= 8.0.26'
  - sinec_infrastructure_network_services < 1.0.1.1
  - h300s_firmware
  - h500s_firmware
  - h700s_firmware
  - h300e_firmware
  - h500e_firmware
  - h700e_firmware
  - h410s_firmware
  - 'universal_forwarder >= 8.2.0, < 8.2.12'
  - 'universal_forwarder >= 9.0.0, < 9.0.6'
  - universal_forwarder = 9.1.0
patched:
  - curl 7.78.0
  - sinec_infrastructure_network_services 1.0.1.1
  - universal_forwarder 9.0.6
published: '2021-08-05'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T11:16:53.617'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-22923'
references:
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf'
    label: support@hackerone.com
  - url: 'https://hackerone.com/reports/1213181'
    label: support@hackerone.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
    label: support@hackerone.com
  - url: 'https://security.gentoo.org/glsa/202212-01'
    label: support@hackerone.com
  - url: 'https://security.netapp.com/advisory/ntap-20210902-0003/'
    label: support@hackerone.com
  - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html'
    label: support@hackerone.com
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://hackerone.com/reports/1213181'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202212-01'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20210902-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-389290.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.01894
epssPercentile: 0.79086
ingestedAt: '2026-10-14T11:27:22.125Z'
---

## Overview

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

## Affected

- `curl >= 7.27.0, < 7.78.0`
- `fedora = 33`
- `cloud_backup`
- `clustered_data_ontap`
- `hci_management_node`
- `solidfire`
- `mysql_server >= 5.7.0, <= 5.7.35`
- `mysql_server >= 8.0.0, <= 8.0.26`
- `sinec_infrastructure_network_services < 1.0.1.1`
- `h300s_firmware`
- `h500s_firmware`
- `h700s_firmware`
- `h300e_firmware`
- `h500e_firmware`
- `h700e_firmware`
- `h410s_firmware`
- `universal_forwarder >= 8.2.0, < 8.2.12`
- `universal_forwarder >= 9.0.0, < 9.0.6`
- `universal_forwarder = 9.1.0`

## Remediation

Upgrade past the affected range:

- `curl 7.78.0`
- `sinec_infrastructure_network_services 1.0.1.1`
- `universal_forwarder 9.0.6`