VulnerabilityAnalyzed

CVE-2021-38120

A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters.

HIGH 7.2EPSS 0.53%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters. This issue affects NetIQ Advance Authentication version before 6.3.5.1.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.53% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-77
Affected: microfocus/netiq advanced authentication
Source: security@opentext.com

References

https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.htmlRelease Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.