CVE-2021-38165

Description

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

Risk Information

Base Score

5.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

4.281

Associated Vulnerability

Vulnerability	OS Platform
lynx security update(DSA-4953-1) lynx_2.8.9rel.1-3+deb10u1_i386.deb	Linux
lynx security update(DSA-4953-1) lynx_2.8.9rel.1-3+deb10u1_amd64.deb	Linux
lynx Security Update (ALAS-2023-2145) lynx-2.8.9-4.amzn2.x86_64.rpm	Linux
lynx Security Update (ALAS-2024-535) lynx-2.8.9-13.amzn2023.0.3.x86_64.rpm	Linux
lynx Security Update (ALAS2-2023-2145) lynx-2.8.9-4.amzn2.x86_64.rpm	Linux
lynx Security Update (ALAS2023-2024-535) lynx-2.8.9-13.amzn2023.0.3.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234