CVE-2021-3784

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda settings manager', an insecure procedure is performed that keeps the created user without an assigned password during some seconds. This could allow a potential attacker to exploit this vulnerability in order to authenticate without knowing the password.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Oct 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-378408.8aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webs CVE-2021-378417.8Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Wind CVE-2021-378427.5metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debu CVE-2021-378439.8The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e.CVE-2021-378453.7An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext ph CVE-2021-378477.5crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.CVE-2021-378487.5common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.CVE-2021-37855.4yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-378505.5ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop t CVE-2021-378517.8Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer CVE-2021-378527.8ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privi CVE-2021-378596.1Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.