What is CVE-2021-37935?

CVE-2021-37935 is a high-severity vulnerability in Huntflow Enterprise, classified under Information Disclosure. CVSS score: 7.5/10. Published 2021-12-10.

How severe is CVE-2021-37935?

High severity. CVSS v3 base score is 7.5 out of 10.

Information disclosure in Huntflow Enterprise

CVE-2021-37935

An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user to get information about the domain name of the configured LDAP server. An attacker could exploit this vulnerability by requesting the login page and searching for the "isLdap" JavaScript parameter in the HTML source code.

Vulnerability class: Information Disclosure

EPSS: 0.014 (69.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Huntflow Huntflow_enterprise
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-37935?: CVE-2021-37935 is a high-severity vulnerability in Huntflow Enterprise, classified under Information Disclosure. CVSS score: 7.5/10. Published 2021-12-10.
How severe is CVE-2021-37935?: High severity. CVSS v3 base score is 7.5 out of 10.