CVE-2021-23335

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
n/ais-user-valid< unspecified

References

Timeline

Published
Feb 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-233365.9The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 CVE-2021-233377.2Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.CVE-2021-233387.2This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.CVE-2021-233396.5This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-CVE-2021-23343.5Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are afCVE-2021-233407.1This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CVE-2021-233417.5The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tCVE-2021-233426.1This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScrCVE-2021-233437.5All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPCVE-2021-233449.8The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.CVE-2021-233455.3All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endCVE-2021-233465.3This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause
CVE-2021-23335: High severity, CVSS 7.5 | Vulnix