CVE-2021-33900
Published: 26 July 2021
Summary
CVE-2021-33900 is a high-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Apache Directory Studio. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 41.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-1565
Vulnerability details
While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects…
more
Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Privacy and security training stresses encryption of sensitive data, reducing missing encryption weaknesses.
Exchange agreements must document security requirements, which would include encryption to protect sensitive data in transit.
The map highlights data actions that involve sensitive data, enabling identification of missing encryption requirements.
Settings can require encryption of sensitive data, preventing missing encryption weaknesses.
Requires encryption and similar controls for CUI processed or stored externally, preventing missing encryption of sensitive data.
Privacy and security requirements placed on external providers, together with monitoring, tangibly reduce missing encryption of sensitive data processed or stored by those services.
Mandates encryption for specified data uses, directly preventing missing encryption of sensitive information.
Policy addresses secure transport and handling of media to avoid cleartext transmission of sensitive information.