CVE-2021-38121 (GCVE-0-2021-38121)

Vulnerability from cvelistv5 – Published: 2024-08-28 06:28 – Updated: 2024-08-28 13:29
VLAI?
Summary
Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.  This issue affects NetIQ Advance Authentication versions before 6.3.5.1
Severity ?
8.3 (High)
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CWE
  • CWE-326 - Inadequate Encryption Strength
Assigner
References
Impacted products
Vendor Product Version
OpenText NetIQ Advance Authentication Affected: 6.3.5.1 , < < (server)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "netiq_advanced_authentication",
            "vendor": "microfocus",
            "versions": [
              {
                "lessThan": "6.3.5.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38121",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-28T13:28:39.335154Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-28T13:29:45.226Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "product": "NetIQ Advance Authentication",
          "vendor": "OpenText",
          "versions": [
            {
              "lessThan": "\u003c",
              "status": "affected",
              "version": "6.3.5.1",
              "versionType": "server"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.\u0026nbsp; This issue affects NetIQ Advance Authentication versions before 6.3.5.1\u003cbr\u003e"
            }
          ],
          "value": "Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.\u00a0 This issue affects NetIQ Advance Authentication versions before 6.3.5.1"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-217",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-217 Exploiting Incorrectly Configured SSL/TLS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-326",
              "description": "CWE-326 Inadequate Encryption Strength",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-28T06:28:43.452Z",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "OpenText"
      },
      "references": [
        {
          "url": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Weak communication protocol identified in Advance Authentication client application",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "OpenText",
    "cveId": "CVE-2021-38121",
    "datePublished": "2024-08-28T06:28:43.452Z",
    "dateReserved": "2021-08-04T20:57:01.489Z",
    "dateUpdated": "2024-08-28T13:29:45.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.3\", \"matchCriteriaId\": \"7D8BAEC8-626A-4520-A89F-DB40CC774D87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"689649F7-75D8-4D13-9A71-50C2908EACA5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1:*:*:*:*:*:*\", \"matchCriteriaId\": \"A0F82417-D88A-40C5-AD90-7AB826E29C2D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2:*:*:*:*:*:*\", \"matchCriteriaId\": \"0DD98BB8-7A85-41D6-B1CB-7849D61F085A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3:*:*:*:*:*:*\", \"matchCriteriaId\": \"729C4860-8CAC-4D4B-8C68-00B1E84E700A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4:*:*:*:*:*:*\", \"matchCriteriaId\": \"FEFFEB38-B4CA-48ED-9149-073334346CA3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B14AC9B7-9339-44BA-BF1B-1876DAFBCA14\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A5CE16C-376A-40C1-83E9-2424AAAB668D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.\\u00a0 This issue affects NetIQ Advance Authentication versions before 6.3.5.1\"}, {\"lang\": \"es\", \"value\": \"Se identifica una versi\\u00f3n del protocolo TLS insuficiente o d\\u00e9bil en la comunicaci\\u00f3n del servidor del cliente de autenticaci\\u00f3n avanzada cuando se accede a un servicio espec\\u00edfico entre dispositivos. Este problema afecta a las versiones de autenticaci\\u00f3n avanzada de NetIQ anteriores a la 6.3.5.1\"}]",
      "id": "CVE-2021-38121",
      "lastModified": "2024-09-13T18:04:16.260",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@opentext.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L\", \"baseScore\": 8.3, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.7, \"impactScore\": 6.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2024-08-28T07:15:07.807",
      "references": "[{\"url\": \"https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html\", \"source\": \"security@opentext.com\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@opentext.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"security@opentext.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-326\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-326\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-38121\",\"sourceIdentifier\":\"security@opentext.com\",\"published\":\"2024-08-28T07:15:07.807\",\"lastModified\":\"2024-09-13T18:04:16.260\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.\u00a0 This issue affects NetIQ Advance Authentication versions before 6.3.5.1\"},{\"lang\":\"es\",\"value\":\"Se identifica una versi\u00f3n del protocolo TLS insuficiente o d\u00e9bil en la comunicaci\u00f3n del servidor del cliente de autenticaci\u00f3n avanzada cuando se accede a un servicio espec\u00edfico entre dispositivos. Este problema afecta a las versiones de autenticaci\u00f3n avanzada de NetIQ anteriores a la 6.3.5.1\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@opentext.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.7,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@opentext.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-326\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-326\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.3\",\"matchCriteriaId\":\"7D8BAEC8-626A-4520-A89F-DB40CC774D87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"689649F7-75D8-4D13-9A71-50C2908EACA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0F82417-D88A-40C5-AD90-7AB826E29C2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DD98BB8-7A85-41D6-B1CB-7849D61F085A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"729C4860-8CAC-4D4B-8C68-00B1E84E700A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4:*:*:*:*:*:*\",\"matchCriteriaId\":\"FEFFEB38-B4CA-48ED-9149-073334346CA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B14AC9B7-9339-44BA-BF1B-1876DAFBCA14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A5CE16C-376A-40C1-83E9-2424AAAB668D\"}]}]}],\"references\":[{\"url\":\"https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html\",\"source\":\"security@opentext.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-38121\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-28T13:28:39.335154Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:*\"], \"vendor\": \"microfocus\", \"product\": \"netiq_advanced_authentication\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"6.3.5.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-28T13:29:40.933Z\"}}], \"cna\": {\"title\": \"Weak communication protocol identified in Advance Authentication client application\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-217\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-217 Exploiting Incorrectly Configured SSL/TLS\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.3, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"OpenText\", \"product\": \"NetIQ Advance Authentication\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3.5.1\", \"lessThan\": \"\u003c\", \"versionType\": \"server\"}], \"platforms\": [\"Windows\", \"Linux\", \"MacOS\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.\\u00a0 This issue affects NetIQ Advance Authentication versions before 6.3.5.1\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.\u0026nbsp; This issue affects NetIQ Advance Authentication versions before 6.3.5.1\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-326\", \"description\": \"CWE-326 Inadequate Encryption Strength\"}]}], \"providerMetadata\": {\"orgId\": \"f81092c5-7f14-476d-80dc-24857f90be84\", \"shortName\": \"OpenText\", \"dateUpdated\": \"2024-08-28T06:28:43.452Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-38121\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-28T13:29:45.226Z\", \"dateReserved\": \"2021-08-04T20:57:01.489Z\", \"assignerOrgId\": \"f81092c5-7f14-476d-80dc-24857f90be84\", \"datePublished\": \"2024-08-28T06:28:43.452Z\", \"assignerShortName\": \"OpenText\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.