Is CVE-2021-37933 actively exploited?

No active exploitation of CVE-2021-37933 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-37933 be exploited remotely?

Yes. CVE-2021-37933 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-37933?

CVE-2021-37933 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2021-37933

HIGH

CVE-2021-37933

CWE-74Published: October 14, 2021· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it to construct LDAP queries. An attacker could bypass authentication exploiting this vulnerability by sending login attempts in which there is a valid password but a wildcard character in email parameter.

NVD Source

Technical Analysis

CVE-2021-37933 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.