PatchTheCVECVE-2021-37933: An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthen
CVE-2021-37933 is a high-severity flaw (CVSS 7.5) affecting huntflow enterprise. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it to construct LDAP queries. An attacker could bypass authentication exploiting this vulnerability by sending login attempts in which there is a valid pas
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.5% (top 26%) |
| CISA exploited list | No |
| Weakness | CWE-74 |
| Published | 2021-10-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-37933?
huntflow enterprise: upgrade to 3.10.6. Exact commands for each OS are on this page.
Is CVE-2021-37933 being exploited?
CVE-2021-37933 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-37933 affect?
CVE-2021-37933 affects huntflow enterprise. Severity is high (CVSS 7.5). An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient serv
How urgent is CVE-2021-37933?
Priority 55/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2021-37935 HIGH 7.5 UPGRADE An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an
- CVE-2021-37934 CRITICAL 9.8 UPGRADE Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow