CVE-2021-43337

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VY34WSSPRPA6MISNYBZWHSGX2SYSEEE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUWNGDQTS7AWFI7FIHUWQOYJSD2IQTCG/
https://lists.schedmd.com/pipermail/slurm-announce/Mailing List, Vendor Advisory
https://lists.schedmd.com/pipermail/slurm-announce/2021/000068.htmlMailing List, Vendor Advisory
https://www.schedmd.com/news.phpVendor Advisory
https://www.schedmd.com/news.php?id=256Patch, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VY34WSSPRPA6MISNYBZWHSGX2SYSEEE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUWNGDQTS7AWFI7FIHUWQOYJSD2IQTCG/
https://lists.schedmd.com/pipermail/slurm-announce/Mailing List, Vendor Advisory
https://lists.schedmd.com/pipermail/slurm-announce/2021/000068.htmlMailing List, Vendor Advisory
https://www.schedmd.com/news.phpVendor Advisory
https://www.schedmd.com/news.php?id=256Patch, Vendor Advisory

Timeline

Published: Nov 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-433398.8In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export CVE-2021-43348.8The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check CVE-2021-43356.3The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a mi CVE-2021-433509.8An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint CVE-2021-433538.8The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settin CVE-2021-433559.8Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without au CVE-2021-433587.5Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks withou CVE-2021-433598.8Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authentica CVE-2021-43369.8A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown CVE-2021-433608.8Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a po CVE-2021-433619.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This CVE-2021-433629.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This