CVE-2021-37935

—

CVSS 3.1

7.5 high

EPSS

1%p70

Published

Dec 10, 2021 (Dec 10, 2021)

Modified

Jun 17, 2026

Description

An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user to get information about the domain name of the configured LDAP server. An attacker could exploit this vulnerability by requesting the login page and searching for the "isLdap" JavaScript parameter in the HTML source code.

Vendors: huntflow
Products: huntflow enterprise
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.