CVE-2021-42837

CRITICAL

Talend Data Catalog < 7.3-20210930 - Authentication Bypass via Native Login Page

Title source: llm

Description

An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login page. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://www.talend.com/resources/

Vendor Advisory x_refsource_confirm

https://jira.talendforge.org/browse/TAPACHE-180

Scores

CVSS v3 9.8

EPSS 0.0116

EPSS Percentile 63.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (1)

talend/data_catalog < 7.3-20210930

Published Nov 05, 2021

Tracked Since Feb 18, 2026