CVE-2021-3652
Medium
Description
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
SeverityMedium
CVSS6.5
Exploit probability—
ProductPort389 389-ds-base
PublishedApr 18, 2022
First seenApr 18, 2022
Weakness typeCWE-287Improper authentication
How to fix
Update
- port389 389-ds-base2.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| port389 389-ds-base | v < 2.0.7 | 2.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.