vesse/node-ldapauth-fork · Security
LDAP Injection in ldapauth
- GHSA ID
- GHSA-82mg-x548-gq3j
- CVE ID
- CVE-2015-7294
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Versions 2.2.4 and earlier of ldapauth-fork are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.
Recommendation
ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use ldapauth-fork 2.3.3 or greater.
CWEs
- CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
References
- https://github.com/vesse/node-ldapauth-fork/issues/21 ↗
- https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4 ↗
- https://www.npmjs.com/advisories/18 ↗
- https://www.npmjs.com/advisories/19 ↗
- http://www.openwall.com/lists/oss-security/2015/09/18/4 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2015-7294 ↗
- http://www.openwall.com/lists/oss-security/2015/09/18/8 ↗
- http://www.openwall.com/lists/oss-security/2015/09/21/2 ↗
- https://github.com/advisories/GHSA-82mg-x548-gq3j ↗