Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2021-33900— StartTLS and SASL confidentiality protection bypass

Quick assessment

Affected
Apache Software Foundation Apache Directory Studio
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Directory Studio是美国阿帕奇（Apache）基金会的一个完整的目录工具平台，旨在与任何 LDAP 服务器一起使用，但它是专门为与 ApacheDS 一起使用而设计的。 Apache Directory Studio 版本 2.0.0.v20210213-M16 和之前的版本存在安全漏洞，该漏洞源于在使用任何 SASL 身份验证机制（DIGEST-MD5、GSSAPI）时未应用配置的 StartTLS 加密。

AI Predicted 5.5 Difficulty: Theoretical EPSS 0.79% · P55
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-33900

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
StartTLS and SASL confidentiality protection bypass
Source: CVE Program / CVE List V5
Vulnerability Description
While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据加密缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Directory Studio 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Directory Studio是美国阿帕奇（Apache）基金会的一个完整的目录工具平台，旨在与任何 LDAP 服务器一起使用，但它是专门为与 ApacheDS 一起使用而设计的。 Apache Directory Studio 版本 2.0.0.v20210213-M16 和之前的版本存在安全漏洞，该漏洞源于在使用任何 SASL 身份验证机制（DIGEST-MD5、GSSAPI）时未应用配置的 StartTLS 加密。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Directory Studio unspecified ~ 2.0.0.v20210213-M16 -

II. Public POCs for CVE-2021-33900

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-33900

请登录查看更多情报信息。

Mailing List Discussions for CVE-2021-33900 (1)

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation
Same weakness: CWE-311

V. Comments for CVE-2021-33900

No comments yet

Leave a comment