CVE-2021-45079

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jan 31, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-450815.9An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.CVE-2021-450827.8An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to imCVE-2021-450837.1An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive informaCVE-2021-450856.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when aCVE-2021-450866.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name valCVE-2021-450876.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by CVE-2021-450886.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.CVE-2021-450895.2Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.CVE-2021-450909.8Stormshield Endpoint Security before 2.1.2 allows remote code execution.CVE-2021-450914.3Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.CVE-2021-450929.8Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameteCVE-2021-450945.4Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.