CVE-2021-3825

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
TUBITAK	Lider	>= unspecified, < 2.1.16

References

https://pentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-me/Exploit, Third Party Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-21-0795
https://www.usom.gov.tr/bildirim/tr-21-0795Third Party Advisory
https://pentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-me/Exploit, Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-21-0795Third Party Advisory

Timeline

Published: Oct 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-382587.8NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback().CVE-2021-38266.5Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of servic CVE-2021-382607.8NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostParseDeviceConfigurationDescriptor().CVE-2021-382636.1Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 befo CVE-2021-382646.1Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject a CVE-2021-382655.4Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrar CVE-2021-382667.5The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 befor CVE-2021-382675.4Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7 CVE-2021-382686.5The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 CVE-2021-382695.4Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 befor CVE-2021-38276.8A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavi CVE-2021-382789.8Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function.