CVE-2021-36780

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
SUSE	Longhorn	>= longhorn, < 1.1.3
SUSE	Longhorn	>= longhorn, < 1.2.3v

References

https://bugzilla.suse.com/show_bug.cgi?id=1191819Issue Tracking, Vendor Advisory
https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhxThird Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1191819Issue Tracking, Vendor Advisory
https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhxThird Party Advisory

Timeline

Published: Dec 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-367814.4A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leadin CVE-2021-367829.9A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Own CVE-2021-367839.9A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners an CVE-2021-367847.2A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This is CVE-2021-367855.4The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.CVE-2021-367867.5The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private key CVE-2021-367875.4The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.CVE-2021-367885.4The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.CVE-2021-367899.8The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.CVE-2021-36795.5A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace r CVE-2021-367906.1The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.CVE-2021-367915.3The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.