CVE-2021-33900
HIGHApache Directory Studio < 2.0.0.v20210717-M17 - Cleartext Transmission of Sensitive Information via StartTLS and SASL
Title source: llmDescription
While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.
References (1)
Core 1
Core References
Mailing List, Vendor Advisory x_refsource_misc
https://lists.apache.org/thread.html/rb1dbcc43a5b406e45d335343a1704f4233de613140a01929d102fdc9%40%3Cusers.directory.apache.org%3E
Scores
CVSS v3
7.5
EPSS
0.0079
EPSS Percentile
51.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-319
CWE-311
Status
published
Products (3)
apache/directory_studio
2.0.0 milestone1 (16 CPE variants)
apache/directory_studio
< 1.5.3
org.apache.directory.studio/org.apache.directory.studio.parent
0 - 2.0.0.v20210717-M17Maven
Published
Jul 26, 2021
Tracked Since
Feb 18, 2026