CVE-2021-3850 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
@huntrdev	CNA	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 59%

Affected Products (NVD)

Vendor	Product	Version
adodb_project	adodb	𝑥 ≤ 5.20.21
debian	debian_linux	9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libphp-adodb

bookworm	5.21.4-1 fixed
bullseye	5.20.19-1+deb11u1 fixed
bullseye (security)	5.20.19-1+deb11u1 fixed
sid	5.22.7-0.1 fixed
trixie	5.22.7-0.1 fixed

Ubuntu Releases

Ubuntu Product

Codename

libphp-adodb

bionic	Fixed 5.20.9-1ubuntu0.1~esm1 released
focal	Fixed 5.20.16-1ubuntu0.1~esm1 released
impish	ignored
jammy	Fixed 5.20.19-1ubuntu0.1 released
kinetic	ignored
lunar	ignored
mantic	not-affected
noble	not-affected
trusty	ignored
xenial	Fixed 5.20.3-1ubuntu1+esm1 released

Known Exploits!

Common Weakness Enumeration

CWE-305 - Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
CWE-287 - Improper Authentication
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

References

https://github.com/adodb/adodb/commit/952de6c4273d9b1e91c2b838044f8c2111150c29

https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c

https://lists.debian.org/debian-lts-announce/2022/02/msg00006.html

https://www.debian.org/security/2022/dsa-5101

https://github.com/adodb/adodb/commit/952de6c4273d9b1e91c2b838044f8c2111150c29

https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c

https://lists.debian.org/debian-lts-announce/2022/02/msg00006.html

https://www.debian.org/security/2022/dsa-5101