PT-2021-23691 · Talend · Talend Data Catalog

Published 2021-11-05 · Updated 2022-07-12 · CVE-2021-42837

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Talend Data Catalog versions prior to 7.3-20210930

Description An issue was discovered in Talend Data Catalog where authentication is not correctly enforced on the native login page after setting up SAML/OAuth. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed.

Recommendations For versions prior to 7.3-20210930, update to version 7.3-20210930 or later to resolve the issue. As a temporary workaround, consider restricting access to the native login page or disabling SAML/OAuth authentication until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-42837

Affected Products

Talend Data Catalog

References · 6

• https://talend.com/resources · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42837 · Security Note
• https://jira.talendforge.org/browse/TAPACHE-180 · Vendor Advisory
• https://t.me/cvenotify/23158 · Telegram Post
• https://t.me/cibsecurity/31914 · Telegram Post