CVE-2021-36794

In Siren Investigate before 11.1.4, when enabling the cluster feature of the Siren Alert application, TLS verifications are disabled globally in the Siren Investigate main process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
VendorProductVersion
sireninvestigate
𝑥
< 11.1.4
𝑥
= Vulnerable software versions
References
https://community.siren.io/c/announcements
https://docs.siren.io/index
https://docs.siren.io/siren-platform-user-guide/11.1/release-notes.html#_security_fixes_3
https://community.siren.io/c/announcements
https://docs.siren.io/index
https://docs.siren.io/siren-platform-user-guide/11.1/release-notes.html#_security_fixes_3