CVE-2021-25312

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Jan 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-253136.1A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to eCVE-2021-253147.8A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux CVE-2021-253157.8CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to CVE-2021-253163.3A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows locCVE-2021-253173.3A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0,CVE-2021-253188.8A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they shouldCVE-2021-253197.8A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groCVE-2021-253209.9A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests withCVE-2021-253217.8A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSCVE-2021-253227.8A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalatCVE-2021-253239.1The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password wheCVE-2021-253246.1MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.
CVE-2021-25312: High severity, CVSS 8.8 | Vulnix