GitHub Advisoryadvisory · Go

GHSA-26cm-qrc6-mfgj Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

HIGH Published 2021-11-08 Modified 2024-02-08 Official page ↗
Aliases
CVE-2021-41232
Ecosystem
Go
Packages
github.com/stevenweathers/thunderdome-planning-poker
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-116, CWE-74, CWE-90
Reviewed
2021-11-02

Affected packages

• Go github.com/stevenweathers/thunderdome-planning-poker: < 1.16.3 → fixed in 1.16.3

Description

Impact LDAP injection vulnerability, only affects instances with LDAP authentication enabled. Patches Patch for vulnerability released with v1.16.3. Workarounds Disable LDAP feature if in use References [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html ) For more information If you have any questions or comments about this advisory: • Open an issue in Thunderdome Github Repository • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-41232 Thunderdome is an open source agile planning poker tool in the theme of Battling for points. vulnerability

Weakness · CWE (3)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query weakness

References