CVE-2021-38120

A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters. This issue affects NetIQ Advance Authentication version before 6.3.5.1.

CVSS v3 5.1 MEDIUM

5.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microfocus:netiq_advanced_authentication::::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5::::::

History

No history.

Information

Published : 2024-08-28 07:15

Updated : 2024-09-13 18:04

NVD link : CVE-2021-38120

Mitre link : CVE-2021-38120

CVE.ORG link : CVE-2021-38120

JSON object : View

Products Affected

microfocus

netiq_advanced_authentication

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2021-38120", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@opentext.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 0.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-08-28T07:15:07.303", "references": [{"url": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html", "tags": ["Release Notes"], "source": "security@opentext.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@opentext.com", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper\nhandling in provided\u00a0command parameters. This issue affects NetIQ Advance Authentication version before 6.3.5.1."}, {"lang": "es", "value": "Una vulnerabilidad identificada en la autenticaci\u00f3n avanzada que permite la inyecci\u00f3n de comandos bash en la funcionalidad de copia de seguridad controlada administrativamente debido a un manejo inadecuado de los par\u00e1metros de comando proporcionados. Este problema afecta a la versi\u00f3n de autenticaci\u00f3n avanzada de NetIQ anterior a la 6.3.5.1."}], "lastModified": "2024-09-13T18:04:28.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D8BAEC8-626A-4520-A89F-DB40CC774D87", "versionEndExcluding": "6.3"}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "689649F7-75D8-4D13-9A71-50C2908EACA5"}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0F82417-D88A-40C5-AD90-7AB826E29C2D"}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DD98BB8-7A85-41D6-B1CB-7849D61F085A"}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "729C4860-8CAC-4D4B-8C68-00B1E84E700A"}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEFFEB38-B4CA-48ED-9149-073334346CA3"}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B14AC9B7-9339-44BA-BF1B-1876DAFBCA14"}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A5CE16C-376A-40C1-83E9-2424AAAB668D"}], "operator": "OR"}]}], "sourceIdentifier": "security@opentext.com"}