When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
Cuando es instruido a curl de obtener contenidos usando la funcionalidad metalink, y se usan un nombre de usuario y una contraseña para descargar el archivo XML metalink, esas mismas credenciales se pasan subsecuentemente a cada uno de los servidores de los que curl descargará o intentará descargar los contenidos. A menudo, en contra de las expectativas e intenciones del usuario y sin avisarle de lo sucedido
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | NONE |
AV:N/AC:H/Au:N/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | HIGH |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-319
|
| [email protected] | Primary |
en
CWE-319
en
CWE-522
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd36945f180> | Application |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd36945cd40> | Operating System |
| netapp | cloud_backup | - | <built-in method update of dict object at 0x7fd2dbd9f400> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7fd36b233680> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd36945e640> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd36945ff00> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd2dbd9da40> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd39c4e5e00> | Application |
| siemens | sinec_infrastructure_network_services | * | <built-in method update of dict object at 0x7fd2dbd9d940> | Application |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd36945df00> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd3686e7180> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd39c4e42c0> | Operating System |
| netapp | h300e_firmware | - | <built-in method update of dict object at 0x7fd39c2a5300> | Operating System |
| netapp | h500e_firmware | - | <built-in method update of dict object at 0x7fd369c05300> | Operating System |
| netapp | h700e_firmware | - | <built-in method update of dict object at 0x7fd2dbd9f1c0> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd38557f6c0> | Operating System |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd36945ed80> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd39c4e4a80> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd36ab74940> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |