PT-2021-20042 · Wekan · Wekan

Robert-Scheck · Published 2021-01-26 · Updated 2021-02-02 · CVE-2021-3309

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 4.87

Description The issue allows Wekan to process connections even though they are not authorized by the Certification Authority trust store. This is due to a problem in the packages/wekan-ldap/server/ldap.js file.

Recommendations For Wekan versions prior to 4.87, update to version 4.87 or later to resolve the issue. As a temporary workaround, consider restricting access to the ldap.js file until a patch is available.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2021-3309

Affected Products

Wekan

References · 7

• 🔥 https://github.com/wekan/wekan/issues/3482 · Exploit
• https://github.com/wekan/wekan/pull/3483/commits/31f89121fecca5a761b05cc3a26d4f237e90b484 · Patch
• https://osv.dev/vulnerability/CVE-2021-3309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3309 · Security Note
• https://github.com/wekan/wekan/releases/tag/v4.87 · Note
• https://t.me/cibsecurity/22688 · Telegram Post
• https://t.me/cvenotify/8988 · Telegram Post