CVE-2021-38132 Possible External service interaction Vulnerability

Medium 5.3 Published 12 Sep 2024 Updated 12 Sep 2024

Attackers can exploit an external service interaction flaw in OpenText eDirectory to access internal resources or bypass security controls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-38132?

CVE-2021-38132 is a medium-severity server-side request forgery vulnerability in OpenText eDirectory, published on 12 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Possible External Service Interaction attack

in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000.

Weakness: CWE-918

Which versions are affected by CVE-2021-38132?

It affects 1 product.

Products include Microfocus Edirectory.

How do I fix CVE-2021-38132?

No fix has been published for CVE-2021-38132 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-38132 being exploited?

There is no known exploitation of CVE-2021-38132 in the wild and no public exploit code.

Sources

Also known as GHSA-7v38-xc68-49j2.