CVE-2021-3309

February 2, 2021

packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,

Summary:

packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,

Reference Links(if available):

  • https://github.com/wekan/wekan/pull/3483/commits/31f89121fecca5a761b05cc3a26d4f237e90b484
  • https://github.com/wekan/wekan/issues/3482
  • https://github.com/wekan/wekan/releases/tag/v4.87

  • CVSS Score (if available)

    v2: / MEDIUM

    v3: /

    Links to Exploits(if available)

  • Tags: , , , ,

    You may have missed

    image

    [LOCKBIT3] – Ransomware Victim: 9fsfalcons[.]org

    December 23, 2024
    image

    [HUNTERS] – Ransomware Victim: SmartLynx Airlines SIA

    December 23, 2024
    image

    [APT73] – Ransomware Victim: linebank[.]co[.]id

    December 23, 2024
    image

    [CACTUS] – Ransomware Victim: galatachemicals[.]com

    December 23, 2024
    image

    [FUNKSEC] – Ransomware Victim: kfar-yona[.]muni[.]il

    December 23, 2024