GitHub Advisoryadvisory · npm

GHSA-82mg-x548-gq3j LDAP Injection in ldapauth

HIGH Published 2020-08-31 Modified 2021-09-23 Official page ↗
Aliases
CVE-2015-7294
Ecosystem
npm
Packages
ldapauth-fork, ldapauth
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-90
Reviewed
2020-08-31

Affected packages

• npm ldapauth-fork: < 2.3.3 → fixed in 2.3.3 • npm ldapauth: < 2.2.4 (no fix yet)

Description

Versions 2.2.4 and earlier of `ldapauth-fork` are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter. Recommendation ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use ldapauth-fork 2.3.3 or greater.

Related

Alias · CVE (1)

  • CVE-2015-7294 ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username. vulnerability

Weakness · CWE (1)

  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query weakness

References