VULNERABILITY INTELLIGENCE

CVE-2021-43935

CVSS score8.1 HIGH

EPSS probability1.15%

CISA KEVNot currently listed

Published2021-12-15

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.

Weakness classification

ics-cert@hq.dhs.gov: CWE-288
nvd@nist.gov: CWE-287

Primary references

ics-cert@hq.dhs.gov — Mitigation, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory, US Government Resource