Skip to main content

Charm CVE-2021-37588

MEDIUM
Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
2021-07-30 cve@mitre.org
Information Disclosure Charm
5.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 30, 2021 - 14:15 nvd
MEDIUM 5.9

DescriptionNVD

In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data.

AnalysisAI

In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-327. In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data. Affected products include: Jhu Charm.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Charm

View all
CVE-2026-30832 CRITICAL POC
9.1 Mar 07

SSRF in Soft Serve Git server versions 0.6.0 to 0.11.3 allows authenticated attackers to make requests to internal servi
CVE-2023-43809 HIGH POC
7.5 Oct 04

Soft Serve is a self-hostable Git server for the command line. Rated high severity (CVSS 7.5), this vulnerability is rem
CVE-2026-24058 CRITICAL
9.8 Jan 22

Soft Serve self-hosted Git server versions 0.11.2 and below have a critical authentication bypass that allows unauthenti
CVE-2022-29180 CRITICAL
9.8 May 07

A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delet
CVE-2026-22253 MEDIUM POC
5.4 Jan 08

Soft Serve versions prior to 0.11.2 contain an authorization bypass in the LFS lock deletion endpoint that allows authen
CVE-2021-37587 MEDIUM
6.5 Jul 30

In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data. Rated medium severity (CVSS 6.5), this vulnerab
CVE-2022-33734 MEDIUM
5.5 Aug 05

Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to

CVE-2022-33733 LOW
3.3 Aug 05

Sensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get
CVE-2025-64522 CRITICAL POC
9.1 Nov 10

Soft Serve is a self-hostable Git server for the command line. Rated critical severity (CVSS 9.1), this vulnerability is
CVE-2025-22130 MEDIUM
5.3 Jan 08

Soft Serve is a self-hostable Git server for the command line. Rated medium severity (CVSS 5.3), this vulnerability is r

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

View all
CVE-2022-3365 CRITICAL POC
9.8
CVE-2014-8687 CRITICAL POC
9.8
CVE-2017-17382 MEDIUM POC
5.9
CVE-2016-6602 CRITICAL POC
9.8
CVE-2023-34039 CRITICAL POC
9.8
CVE-2025-2539 HIGH POC
7.5
CVE-2017-9466 CRITICAL POC
9.8
CVE-2023-5347 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2021-37588 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy