by Kastro
Paper/Archive/CVE-2021-3825

CVE-2021-3825

TUBITAK Lider — Missing Authorization Checks in LiderAhenk

EPSS 2%CVSS 9.6
critical.is priorityof 100
44
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 76.1.761 × 2015.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.

Affected

ProductAffectedFixed inSource
Liderunspecified – < 2.1.162.1.16CNA

Scores by source

TR-CERT (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refusom.gov.tr/bildirim/tr-21-0795refpentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-merefsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-21-0795