PT-2022-11831 · Unisys · Unisys Os 2200 Messaging Integration Services

Published 2022-01-24 · Updated 2022-01-31 · CVE-2021-43394

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unisys OS 2200 Messaging Integration Services (NTSI) versions 7R3B IC3 and IC4, 7R3C, and 7R3D

Description The issue is related to an incorrect implementation of an authentication algorithm. Specifically, an LDAP password is not properly validated, which can lead to security concerns.

Recommendations For Unisys OS 2200 Messaging Integration Services (NTSI) versions 7R3B IC3 and IC4, 7R3C, and 7R3D, consider temporarily restricting access to LDAP authentication until a proper fix is available. As a mitigation measure, review and strengthen password validation mechanisms to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-43394

Affected Products

Unisys Os 2200 Messaging Integration Services

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-43394 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43394 · Vendor Advisory
• https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=66 · Vendor Advisory
• https://t.me/cibsecurity/36173 · Telegram Post