High severity · published Jan 26, 2021
CVE-2021-3309
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,
8.1
CVSS
1.7%
EPSS
No
On KEV
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Wekan · Wekan Project
before 4.87 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3309
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3309
Exploit
https://github.com/wekan/wekan/issues/3482
Patch
https://github.com/wekan/wekan/pull/3483/commits/31f89121fecca5a761b05cc3a26d4f237e90b484
Release Notes
https://github.com/wekan/wekan/releases/tag/v4.87
More from Wekan
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.8
CVE-2026-1963
WeKan Attachment Storage attachments.js MoveStorageBleed access control
9.8
CVE-2026-1962
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
8.8
CVE-2026-2206
WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
8.8
CVE-2026-25859
WeKan < 8.20 Migration Functionality Insufficient Permission Checks