PT-2024-10884 · Netiq · Netiq Advance Authentication

Published 2024-08-27 · Updated 2024-09-13 · CVE-2021-22530

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions NetIQ Advance Authentication versions prior to 6.3.5.1

Description A vulnerability identified in NetIQ Advance Authentication does not enforce account lockout when a brute force attack is performed on API-based login. This issue may lead to user account compromise if successful or may impact server performance.

Recommendations For versions prior to 6.3.5.1, update to version 6.3.5.1 to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent brute force attacks on the API-based login. Restrict access to the API endpoint to minimize the risk of exploitation. Avoid using the API-based login until the issue is resolved by updating to the recommended version.

Fix

Improper Restriction of Excessive Authentication Attempts

Improper Locking

Weakness Enumeration

CWE-307

CWE-667

Related Identifiers

CVE-2021-22530

Affected Products

Netiq Advance Authentication

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-22530 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22530 · Vendor Advisory
• https://t.me/cvenotify/92443 · Telegram Post
• https://twitter.com/CVEnew/status/1828684716112834651 · Twitter Post
• https://twitter.com/transilienceai/status/1830248189426798627 · Twitter Post
• https://twitter.com/cracbot/status/1830123548855468442 · Twitter Post
• https://t.me/cvedetector/4314 · Telegram Post
• https://netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html · Note