CVE-2021-45379

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/babelouest/glewlwyd/commit/125281f1c0d4b6a8b49f7e55a757205a2ef01fbePatch, Third Party Advisory
https://github.com/babelouest/glewlwyd/releases/tag/v2.6.1Release Notes, Third Party Advisory
https://github.com/babelouest/glewlwyd/commit/125281f1c0d4b6a8b49f7e55a757205a2ef01fbePatch, Third Party Advisory
https://github.com/babelouest/glewlwyd/releases/tag/v2.6.1Release Notes, Third Party Advisory

Timeline

Published: Dec 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-453806.1AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inc_head.php CVE-2021-453829.8A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-CVE-2021-453856.5A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load(). When the size information in metadata of the bm CVE-2021-453865.5tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c CVE-2021-453875.5tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.CVE-2021-453899.8A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process CVE-2021-453917.5A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in the goform/setIPv6Status binary fi CVE-2021-453927.5A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the CVE-2021-453948.8An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malic CVE-2021-454019.8A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via th CVE-2021-454025.5The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the CVE-2021-454068.8In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a