Attacker Value
Unknown
CVE-2021-22898
CVE-2021-22898
(Last updated March 28, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
3.1 Low
Impact Score:
1.4
Exploitability Score:
1.6
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
Low
Integrity (I):
None
Availability (A):
None
General Information
Vendors
- debian,
- fedoraproject,
- haxx,
- oracle,
- siemens,
- splunk
Products
- communications cloud native core binding support function 1.11.0,
- communications cloud native core network function cloud native environment 1.10.0,
- communications cloud native core network repository function 1.15.0,
- communications cloud native core network repository function 1.15.1,
- communications cloud native core network slice selection function 1.8.0,
- communications cloud native core service communication proxy 1.15.0,
- curl,
- debian linux 9.0,
- essbase,
- fedora 33,
- fedora 34,
- mysql server,
- sinec infrastructure network services,
- universal forwarder,
- universal forwarder 9.1.0
References
Advisory
Miscellaneous
