Auth bypass in Port389 389-Ds-Base
CVE-2021-3652
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
Vulnerability class: Broken Authentication
EPSS: 0.015 (71.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Port389 389-ds-base
- N/a 389-ds-base — versions 389-ds-base 2.0.7
Weakness classification (CWE)
References
- secalert@redhat.com (Third Party Advisory, Issue Tracking)
- secalert@redhat.com (Patch, Third Party Advisory)
- secalert@redhat.com (mailing-list)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2021-3652?
- CVE-2021-3652 is a medium-severity vulnerability in Port389 389-Ds-Base, classified under Improper Authentication. CVSS score: 6.5/10. Published 2022-04-18.
- How severe is CVE-2021-3652?
- Medium severity. CVSS v3 base score is 6.5 out of 10.