Vulnerability record · CVE-2021-3652 · published 18 April 2022

CVE-2021-3652: Port389 389-ds-base improper authentication vulnerability

Port389 · 389 Ds Base

A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.

6.5 CVSS 3.1 Medium EPSS 1.5% · top 26.4% CWE-287 · Improper authentication

6.5CVSS 3.1 base score, v2 6.4

1.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

7References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

389 Ds Base Port389

References

Link	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1982782	Issue TrackingThird Party Advisory
https://github.com/389ds/389-ds-base/issues/4817	PatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
https://bugzilla.redhat.com/show_bug.cgi?id=1982782	Issue TrackingThird Party Advisory
https://github.com/389ds/389-ds-base/issues/4817	PatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html

Track CVE-2021-3652 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2022-0918Port389 389-ds-base vulnerabilityA vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a de…EPSS 5.9%16 Mar 2022 7.5CVE-2021-4091Port389 389-ds-base double free vulnerabilityA double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search r…EPSS 2.0%18 Feb 2022 6.5CVE-2022-2850Redhat directory server null pointer dereference vulnerabilityA flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using…EPSS 1.6%14 Oct 2022 5.5CVE-2026-105133Ahsay cloud backup suite improper authentication vulnerabilityA vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.jav…KEVEPSS 0.85%4 Oct 2026 7.5CVE-2026-42018JFrog Artifactory improper authentication leaks anonymous tokenJFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token …KEVEPSS 9.8%analysed12 Aug 2026 9.8CVE-2026-82329JFrog Artifactory improper authentication allows admin takeoverJFrog Artifactory contains an improper authentication weakness (CWE-287) that, under default configuration, may let an unauthenticated attacker with …KEVEPSS 14%analysed28 Aug 2026 8.8CVE-2026-59822LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallbackLiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAu…KEVEPSS 0.84%analysed8 Jul 2026 10.0CVE-2026-49869Kestra OSS auth bypass via path suffix match enables RCEKestra OSS AuthenticationFilter whitelists the public config endpoint using request.getPath().endsWith("/configs"), a suffix match instead of an exac…KEVEPSS 2.1%analysed26 Jun 2026

Source: NIST National Vulnerability Database (record CVE-2021-3652), CISA KEV, FIRST EPSS (scores of 2026-10-17). This page is refreshed as NVD updates the record.