CVE-2021-37935

7.5 highEPSS 1.4%

High (7.5) in huntflow huntflow enterprise. EPSS 1.4% chance of exploitation in the next 30 days.

An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user to get information about the domain name of the configured LDAP server. An attacker could exploit this vulnerability by requesting the login page and searching for the "isLdap" JavaScript parameter in the HTML source code.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2021-12-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

huntflow:huntflow_enterprise

References

https://gist.github.com/andrey-lomtev/c970fb7dd022d04f5b57ad37fbedd064
https://gist.github.com/andrey-lomtev/c970fb7dd022d04f5b57ad37fbedd064

Check your stack JSON