CVE-2021-21335

Katalog CVE

CVSS 9.8 · Critical EPSS 1,7%

Kerentanan Improper Authentication pada spnego http authentication module project spnego http authentication module. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.

Rincian

Terbit di NVD

8 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/stnoonan/spnego-http-auth-nginx-module/commit/a06f9efca373e25328b1c53639a48decd0854570 patch · advisory pihak ketiga
• https://github.com/stnoonan/spnego-http-auth-nginx-module/security/advisories/GHSA-ww8q-72rx-hc54 patch · advisory pihak ketiga
• https://github.com/stnoonan/spnego-http-auth-nginx-module/releases/tag/v1.1.1 advisory pihak ketiga