« Volver al listado

CVE-2021-38120

Estado: AnalizadaAlta (7.2)—

A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters. This issue affects NetIQ Advance Authentication version before 6.3.5.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microfocus — Netiq Advanced Authentication

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-38120",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-38120",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-28T13:19:09.339664Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@opentext.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.1,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 0.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "OpenText",
          "product": "NetIQ Advance Authentication",
          "versions": [
            {
              "status": "affected",
              "version": "6.3.5.1",
              "lessThan": "<",
              "versionType": "server"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-08-28T07:15:07.303",
  "references": [
    {
      "url": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html",
      "tags": [
        "Release Notes"
      ],
      "source": "security@opentext.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@opentext.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper\nhandling in provided command parameters. This issue affects NetIQ Advance Authentication version before 6.3.5.1."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad identificada en la autenticación avanzada que permite la inyección de comandos bash en la funcionalidad de copia de seguridad controlada administrativamente debido a un manejo inadecuado de los parámetros de comando proporcionados. Este problema afecta a la versión de autenticación avanzada de NetIQ anterior a la 6.3.5.1."
    }
  ],
  "lastModified": "2026-06-17T04:01:30.923",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D8BAEC8-626A-4520-A89F-DB40CC774D87",
              "versionEndExcluding": "6.3"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "689649F7-75D8-4D13-9A71-50C2908EACA5"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0F82417-D88A-40C5-AD90-7AB826E29C2D"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DD98BB8-7A85-41D6-B1CB-7849D61F085A"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "729C4860-8CAC-4D4B-8C68-00B1E84E700A"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEFFEB38-B4CA-48ED-9149-073334346CA3"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B14AC9B7-9339-44BA-BF1B-1876DAFBCA14"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A5CE16C-376A-40C1-83E9-2424AAAB668D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}