CVE-2021-3652

A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.

• CWE-287

• https://bugzilla.redhat.com/show_bug.cgi?id=1982782Issue Tracking, Third Party Advisory
• https://github.com/389ds/389-ds-base/issues/4817Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1982782Issue Tracking, Third Party Advisory
• https://github.com/389ds/389-ds-base/issues/4817Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
• https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html

Published

Apr 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3649chatwoot is vulnerable to Inefficient Regular Expression Com…7.5
• CVE-2021-36493Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allo…7.5
• CVE-2021-36503SQL injection vulnerability in native-php-cms 1.0 allows rem…9.8
• CVE-2021-3651Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36512An issue was discovered in function scanallsubs in src/sbbs3…7.5
• CVE-2021-36513An issue was discovered in function sofia_handle_sip_i_notif…7.5
• CVE-2021-36520A SQL injection vulnerability in I-Tech Trainsmart r1044 exi…7.5
• CVE-2021-3653A flaw was found in the KVM's AMD code for supporting SVM ne…8.8
• CVE-2021-36530ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c…8.8
• CVE-2021-36531ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70…8.8
• CVE-2021-36532Race condition vulnerability discovered in portfolioCMS 1.0 …8.1
• CVE-2021-36535Buffer Overflow vulnerability in Cesanta mJS 1.26 allows rem…5.5