CVE-2021-43834

Katalog CVE

CVSS 9.8 · Critical EPSS 1,0%

Kerentanan Improper Authentication pada elabftw. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate as an existing user, if that user was created using a single sign-on authentication option such as LDAP or SAML. It impacts instances where LDAP or SAML is used for authentication instead of the (default) local password mechanism. Users should upgrade to at least version 4.2.0.

Rincian

Terbit di NVD

16 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/elabftw/elabftw/releases/tag/4.2.0 release notes · advisory pihak ketiga
• https://github.com/elabftw/elabftw/security/advisories/GHSA-98rp-gx76-33ph advisory pihak ketiga