Description
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
Affected products
haxx: curl; fedoraproject: fedora; netapp: cloud backup; netapp: clustered data ontap; netapp: hci management node; netapp: solidfire; oracle: mysql server; siemens: sinec infrastructure network services; netapp: h300s firmware; netapp: h300s; netapp: h500s firmware; netapp: h500s; netapp: h700s firmware; netapp: h700s; netapp: h300e firmware
References10
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- hackerone.com/reports/1213181 ExploitIssue TrackingThird Party Advisory
- hackerone.com/reports/1213181 ExploitIssue TrackingThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.… Mailing ListThird Party Advisory
- security.gentoo.org/glsa/202212-01 Third Party Advisory
- security.netapp.com/advisory/ntap-20210902-0003/ Third Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.… Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 2% percentile: 81 · as of 4 November 2026
- CWE
- CWE-319CWE-522
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.