CVE-2021-3652

 

Published at: - 18-04-2022 07:15

Last modified: - 27-04-2022 05:15

Total changes: - 2

Description

A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/389ds/389-ds-base/issues/4817
• https://bugzilla.redhat.com/show_bug.cgi?id=1982782

 

Keywords

NVD

 

CVE-2021-3652

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures