Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yNmNtLXFyYzYtbWZnas0W0A

Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

Impact

LDAP injection vulnerability, only affects instances with LDAP authentication enabled.

Patches

Patch for vulnerability released with v1.16.3.

Workarounds

Disable LDAP feature if in use

References

OWASP LDAP Injection Prevention Cheat Sheet

For more information

If you have any questions or comments about this advisory:

• Open an issue in Thunderdome Github Repository
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-26cm-qrc6-mfgj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNmNtLXFyYzYtbWZnas0W0A
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 3 months ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Identifiers: GHSA-26cm-qrc6-mfgj, CVE-2021-41232
References:

• https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgj
• https://nvd.nist.gov/vuln/detail/CVE-2021-41232
• https://github.com/github/securitylab/issues/464#issuecomment-957094994
• https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1
• https://github.com/advisories/GHSA-26cm-qrc6-mfgj

Repository: https://github.com/StevenWeathers/thunderdome-planning-poker
Blast Radius: 1.0

Affected Packages