Critical severity · published Jan 25, 2022
CVE-2021-3850
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21
9.1
CVSS
2.2%
EPSS
No
On KEV
Description
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Adodb · Adodb Project
through 5.20.21 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3850
Patch
https://github.com/adodb/adodb/commit/952de6c4273d9b1e91c2b838044f8c2111150c29
Exploit
https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c
Mailing List
https://lists.debian.org/debian-lts-announce/2022/02/msg00006.html
Third Party Advisory
https://www.debian.org/security/2022/dsa-5101
More from Adodb
9.8
CVE-2016-7405
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to…
6.1
CVE-2016-4855
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors