{"id":"CVE-2021-3618","published":"2022-03-23T00:00:00Z","modified":"2024-08-03T17:01:07Z","title":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"ALPACA","versions":["vsftpd 3.0.4, nginx 1.21.0, sendmail 8.17"]}],"description":{"text":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.02027,"percentile":0.81015,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-295","name":"Improper Certificate Validation"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975623","tags":[]},{"url":"https://alpaca-attack.com/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html","tags":["mailing-list"]}],"techniques":[],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"▪ ALPACA Attack(CVE-2021-3618)","start":45510,"end":45540}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-26922","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26922","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-03-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-3618","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":20.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.2,"detail":"percentile 0.8102"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}