PT-2024-10881 · Netiq · Netiq Advance Authentication

Frank Spierings · Published 2024-08-27 · Updated 2024-09-13 · CVE-2021-22509

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions NetIQ Advance Authentication versions prior to 6.3.5.1

Description A vulnerability identified in storing and reusing information in Advance Authentication can lead to leakage of sensitive data to unauthorized users.

Recommendations Update to version 6.3.5.1 or later to secure your systems. As a temporary workaround, consider restricting access to sensitive data stored in Advance Authentication until the update is applied.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-22509

Affected Products

Netiq Advance Authentication

References · 10

• https://osv.dev/vulnerability/CVE-2021-22509 · Vendor Advisory
• https://netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22509 · Security Note
• https://twitter.com/transilienceai/status/1830248176026001653 · Twitter Post
• https://twitter.com/transilienceai/status/1830248168551829575 · Twitter Post
• https://t.me/cvenotify/94554 · Telegram Post
• https://twitter.com/CVEnew/status/1828684713998844162 · Twitter Post
• https://t.me/cvedetector/4315 · Telegram Post
• https://t.me/cvenotify/92441 · Telegram Post
• https://twitter.com/cracbot/status/1830123547207090654 · Twitter Post