VulnerabilityAnalyzed

CVE-2021-38121

Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.

HIGH 8.8EPSS 0.18%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices. This issue affects NetIQ Advance Authentication versions before 6.3.5.1

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.18% probability · 8th percentile
CISA KEV: Not listed
Weakness: CWE-326
Affected: microfocus/netiq advanced authentication
Source: security@opentext.com

References

https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.htmlRelease Notes, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.