Read the docs
TI-2021-13214 Aliases CVE-2021-33900GHSA-4x25-f45x-grv5

StartTLS and SASL confidentiality protection bypass

Priority LOW 34CWE-311Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-311.

Summary

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.

Why it matters now

EPSS 0.00793 56th percentileScored 2026-11-07
Fix Fixed org.apache.directory.studio:org.apache.directory.studio.parent (Maven): 2.0.0.v20210717-M17

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Directory Studioup to 2.0.0.v20210213-M16—No fix listedCNA
—org.apache.directory.studio:org.apache.directory.studio.parent (Maven)before 2.0.0.v20210717-M172.0.0.v20210717-M17Patch availableGHSA-4x25-f45x-grv5
  • Apache Directory Studio VendorApache Affected up to 2.0.0.v20210213-M16 Fixed in — No fix listed CNA
  • org.apache.directory.studio:org.apache.directory.studio.parent (Maven) Vendor— Affected before 2.0.0.v20210717-M17 Fixed in 2.0.0.v20210717-M17 Patch available GHSA-4x25-f45x-grv5

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:apache:directory_studio:*:*:*:*:*:*:*:*up to 1.5.3VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone1:*:*:*:*:*:*2.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone10:*:*:*:*:*:*2.0.0 milestone10VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone11:*:*:*:*:*:*2.0.0 milestone11VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone12:*:*:*:*:*:*2.0.0 milestone12VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone13:*:*:*:*:*:*2.0.0 milestone13VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone14:*:*:*:*:*:*2.0.0 milestone14VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone15:*:*:*:*:*:*2.0.0 milestone15VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone16:*:*:*:*:*:*2.0.0 milestone16VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone2:*:*:*:*:*:*2.0.0 milestone2VulnerableApache
  • cpe:2.3:a:apache:directory_studio:*:*:*:*:*:*:*:* Versions up to 1.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone1:*:*:*:*:*:* Versions 2.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone10:*:*:*:*:*:* Versions 2.0.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone11:*:*:*:*:*:* Versions 2.0.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone12:*:*:*:*:*:* Versions 2.0.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone13:*:*:*:*:*:* Versions 2.0.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone14:*:*:*:*:*:* Versions 2.0.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone15:*:*:*:*:*:* Versions 2.0.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone16:*:*:*:*:*:* Versions 2.0.0 milestone16 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone2:*:*:*:*:*:* Versions 2.0.0 milestone2 Vulnerable ·Apache
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:directory_studio:2.0.0:milestone3:*:*:*:*:*:*2.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone4:*:*:*:*:*:*2.0.0 milestone4VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone5:*:*:*:*:*:*2.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone6:*:*:*:*:*:*2.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone7:*:*:*:*:*:*2.0.0 milestone7VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone8:*:*:*:*:*:*2.0.0 milestone8VulnerableApache
cpe:2.3:a:apache:directory_studio:2.0.0:milestone9:*:*:*:*:*:*2.0.0 milestone9VulnerableApache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone3:*:*:*:*:*:* Versions 2.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone4:*:*:*:*:*:* Versions 2.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone5:*:*:*:*:*:* Versions 2.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone6:*:*:*:*:*:* Versions 2.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone7:*:*:*:*:*:* Versions 2.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone8:*:*:*:*:*:* Versions 2.0.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:directory_studio:2.0.0:milestone9:*:*:*:*:*:* Versions 2.0.0 milestone9 Vulnerable ·Apache

Remediation

  • Fix · GHSA-4x25-f45x-grv5 org.apache.directory.studio:org.apache.directory.studio.parent (Maven) Fixed in 2.0.0.v20210717-M17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33900
  2. 2026-10-03 Alias added: GHSA-4x25-f45x-grv5

References

Advisory 2

  • TI-2015-04503 The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does… CVSS 3.0HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences