Description

ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.

Remediation

References

http://www.openwall.com/lists/oss-security/2015/09/18/8

http://www.openwall.com/lists/oss-security/2015/09/21/2

https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4

https://github.com/vesse/node-ldapauth-fork/issues/21

Related Vulnerabilities

CVE-2019-10377 Vulnerability in maven package net.hurstfrost.jenkins:avatar

CVE-2023-46653 Vulnerability in maven package org.jenkins-ci.plugins:lambdatest-automation

CVE-2022-23615 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2022-45462 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-alert-plugins

CVE-2023-35148 Vulnerability in maven package org.jenkins-ci.plugins:ease-plugin

Severity

High

Classification

CWE-90 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List VDB Entry Patch Third Party Advisory