PT-2021-21927 · Unknown · Huntflow Enterprise

Andrey Lomtev · Published 2021-12-10 · Updated 2021-12-14 · CVE-2021-37935

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Huntflow Enterprise versions prior to 3.10.4

Description: An information disclosure issue in the login page could allow an unauthenticated, remote user to obtain information about the domain name of the configured LDAP server. This can be exploited by requesting the login page and searching for the isLdap JavaScript parameter in the HTML source code.

Recommendations: For versions prior to 3.10.4, update to version 3.10.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-37935

Affected Products

Huntflow Enterprise

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-37935 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37935 · Vendor Advisory
• https://t.me/cibsecurity/33749 · Telegram Post
• https://gist.github.com/andrey-lomtev/c970fb7dd022d04f5b57ad37fbedd064 · Note
• https://t.me/cvenotify/24531 · Telegram Post