PT-2024-10988 · Netiq · Netiq Advance Authentication

Published 2024-08-27 · Updated 2024-09-13 · CVE-2021-38120

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetIQ Advance Authentication versions prior to 6.3.5.1

Description A vulnerability identified in Advance Authentication allows bash command injection in administrative controlled functionality of backup due to improper handling in provided command parameters.

Recommendations For versions prior to 6.3.5.1, update to version 6.3.5.1 to protect against exploitation. As a temporary workaround, consider restricting access to the administrative controlled functionality of backup until a patch is available. Avoid using the affected functionality in the backup process until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-38120

Affected Products

Netiq Advance Authentication

References · 8

• https://osv.dev/vulnerability/CVE-2021-38120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38120 · Security Note
• https://t.me/cvedetector/4311 · Telegram Post
• https://t.me/cvenotify/92444 · Telegram Post
• https://twitter.com/CVEnew/status/1828684717165539607 · Twitter Post
• https://t.me/cvenotify/94556 · Telegram Post
• https://twitter.com/transilienceai/status/1830248196917846042 · Twitter Post
• https://netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html · Note