Description

ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.

Remediation

References

https://github.com/vesse/node-ldapauth-fork/issues/21

https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4

http://www.openwall.com/lists/oss-security/2015/09/21/2

http://www.openwall.com/lists/oss-security/2015/09/18/8

Related Vulnerabilities

CVE-2015-8851 Vulnerability in maven package org.webjars.bower:node-uuid

CVE-2022-31127 Vulnerability in npm package next-auth

CVE-2023-43502 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2018-6333 Vulnerability in npm package nuclide

CVE-2022-31943 Vulnerability in maven package net.mingsoft:ms-mcms

Severity

High

Classification

CWE-90 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory Patch Mailing List VDB Entry