Attacker Value
Unknown
CVE-2021-22946
CVE-2021-22946
(Last updated March 28, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None
General Information
Vendors
- apple,
- debian,
- fedoraproject,
- haxx,
- netapp,
- oracle,
- siemens,
- splunk
Products
- cloud backup -,
- clustered data ontap -,
- commerce guided search 11.3.2,
- communications cloud native core binding support function 1.11.0,
- communications cloud native core binding support function 22.1.3,
- communications cloud native core console 22.2.0,
- communications cloud native core network function cloud native environment 1.10.0,
- communications cloud native core network repository function 1.15.0,
- communications cloud native core network repository function 1.15.1,
- communications cloud native core network repository function 22.1.0,
- communications cloud native core network repository function 22.2.0,
- communications cloud native core network slice selection function 1.8.0,
- communications cloud native core security edge protection proxy 22.1.1,
- communications cloud native core service communication proxy 1.15.0,
- curl,
- debian linux 10.0,
- debian linux 11.0,
- debian linux 9.0,
- fedora 33,
- fedora 35,
- h300e firmware -,
- h300s firmware -,
- h410s firmware -,
- h500e firmware -,
- h500s firmware -,
- h700e firmware -,
- h700s firmware -,
- macos,
- mysql server,
- oncommand insight -,
- oncommand workflow automation -,
- peoplesoft enterprise peopletools 8.57,
- peoplesoft enterprise peopletools 8.58,
- peoplesoft enterprise peopletools 8.59,
- sinec infrastructure network services,
- snapcenter -,
- solidfire baseboard management controller firmware -,
- universal forwarder,
- universal forwarder 9.1.0
References
Advisory
