Cyber Resilience

CVE-2021-22876

MediumPublic PoC

Published: 01 April 2021

Published
01 April 2021
Modified
09 June 2025
KEV Added
Patch
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0011 29.8th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-22876 is a medium-severity Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) vulnerability in Fedoraproject Fedora. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 29.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating…

more

the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

haxx
libcurl
7.1.1 — 7.75.0
fedoraproject
fedora
32, 33, 34
netapp
hci management node
all versions
netapp
solidfire
all versions
netapp
hci compute node
all versions
netapp
hci storage node
all versions
broadcom
fabric operating system
all versions
debian
debian linux
9.0
siemens
sinec infrastructure network services
≤ 1.0.1.1
oracle
communications billing and revenue management
12.0.0.3.0
+2 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-359

Automated marking applies security attributes to system outputs, making it harder for attackers to exploit unmarked sensitive information leading to unauthorized exposure.

addresses: CWE-200 CWE-359

Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.

addresses: CWE-200 CWE-359

Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors.

addresses: CWE-200 CWE-359

Data mining protection mechanisms detect and block unauthorized bulk extraction of sensitive data, directly mitigating exposure to unauthorized actors.

addresses: CWE-200 CWE-359

Literacy training teaches users to recognize and avoid actions that result in unauthorized exposure of sensitive information.

addresses: CWE-200 CWE-359

Documenting information locations and authorized users enables better protection against unauthorized exposure of sensitive data.

addresses: CWE-200 CWE-359

Privacy and security architectures require controls to protect sensitive information from unauthorized exposure across the system lifecycle.

addresses: CWE-200 CWE-359

Requiring detailed, requestable records of every PII disclosure directly aids detection of unauthorized exposures of sensitive information.

References