ByteOS Network

NVD Vulnerability Details :

CVE-2021-3825

Modified

Source-iletisim@usom.gov.tr

Published At-01 Oct, 2021 | 15:15

Updated At-18 May, 2026 | 09:16

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.6	CRITICAL	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 9.6

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

pardus>>liderahenk>>Versions up to 2.1.15(inclusive)

cpe:2.3:a:pardus:liderahenk:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-306	Secondary	iletisim@usom.gov.tr
CWE-306	Secondary	nvd@nist.gov

CWE ID: CWE-306

Type: Secondary

Source: iletisim@usom.gov.tr

CWE ID: CWE-306

Type: Secondary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://pentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-me/	iletisim@usom.gov.tr	Exploit Third Party Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-21-0795	iletisim@usom.gov.tr	N/A
https://www.usom.gov.tr/bildirim/tr-21-0795	iletisim@usom.gov.tr	Third Party Advisory
https://pentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-me/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-21-0795	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory