CVE-2021-43337

SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access.

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VY34WSSPRPA6MISNYBZWHSGX2SYSEEE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUWNGDQTS7AWFI7FIHUWQOYJSD2IQTCG/
• https://lists.schedmd.com/pipermail/slurm-announce/Mailing List, Vendor Advisory
• https://lists.schedmd.com/pipermail/slurm-announce/2021/000068.htmlMailing List, Vendor Advisory
• https://www.schedmd.com/news.phpVendor Advisory
• https://www.schedmd.com/news.php?id=256Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VY34WSSPRPA6MISNYBZWHSGX2SYSEEE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUWNGDQTS7AWFI7FIHUWQOYJSD2IQTCG/
• https://lists.schedmd.com/pipermail/slurm-announce/Mailing List, Vendor Advisory
• https://lists.schedmd.com/pipermail/slurm-announce/2021/000068.htmlMailing List, Vendor Advisory
• https://www.schedmd.com/news.phpVendor Advisory
• https://www.schedmd.com/news.php?id=256Patch, Vendor Advisory

Published

Nov 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4333The WP Statistics plugin for WordPress is vulnerable to Cros…6.5
• CVE-2021-43331In GNU Mailman before 2.1.36, a crafted URL to the Cgi/optio…6.1
• CVE-2021-43332In GNU Mailman before 2.1.36, the CSRF token for the Cgi/adm…6.5
• CVE-2021-43333The Datalogic DXU service on (for example) DL-Axist devices …6.5
• CVE-2021-43334BuddyBoss Platform through 1.8.0 allows XSS via the Group Na…5.4
• CVE-2021-43336An Out-of-Bounds Write vulnerability exists when reading a D…7.8
• CVE-2021-43338Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43339In Ericsson Network Location before 2021-07-31, it is possib…8.8
• CVE-2021-4334The Fancy Product Designer plugin for WordPress is vulnerabl…8.8
• CVE-2021-4335The Fancy Product Designer plugin for WordPress is vulnerabl…6.3
• CVE-2021-43350An unauthenticated Apache Traffic Control Traffic Ops user c…9.8
• CVE-2021-43351Rejected reason: This is unused.