CVE-2021-33900CWE-311

StartTLS and SASL confidentiality protection bypass

published July 26, 2021

CVSS
—
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00793 · 55.9th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2021-07-26T07:05Z
EPSS history
Timeline
  • 26 JUL 07:05Z
    StartTLS and SASL confidentiality protection bypass
    cvelistv5