CVE-2021-3652
389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 29, 2021
Updated · November 21, 2025
Description
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-287 · Improper Authentication