Medium severity · published Apr 18, 2022
CVE-2021-3652
A flaw was found in 389-ds-base
6.5
CVSS
1.5%
EPSS
No
On KEV
Description
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
38
389-ds-base · Port389
before 2.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3652
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3652
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1982782
Patch
https://github.com/389ds/389-ds-base/issues/4817
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html
More from 389-ds-base
7.5
CVE-2022-0918
A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service
7.5
CVE-2021-4091
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches
6.5
CVE-2022-2850
A flaw was found In 389-ds-base