Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTgybWcteDU0OC1ncTNq

LDAP Injection in ldapauth

Versions 2.2.4 and earlier of ldapauth-fork are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.

Recommendation

ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use ldapauth-fork 2.3.3 or greater.

Permalink: https://github.com/advisories/GHSA-82mg-x548-gq3j
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTgybWcteDU0OC1ncTNq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 4 years ago
Updated: over 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-82mg-x548-gq3j, CVE-2015-7294
References: Repository: https://github.com/vesse/node-ldapauth-fork
Blast Radius: 23.0

Affected Packages

npm:ldapauth
Dependent packages: 9
Dependent repositories: 44
Downloads: 35 last month
Affected Version Ranges: < 2.2.4
No known fixed version
All affected versions: 1.0.0, 1.0.1, 1.0.2, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.2.2, 2.2.3
npm:ldapauth-fork
Dependent packages: 52
Dependent repositories: 1,169
Downloads: 133,253 last month
Affected Version Ranges: < 2.3.3
Fixed in: 2.3.3
All affected versions: 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 2.2.16, 2.2.17, 2.2.18, 2.2.19, 2.3.0, 2.3.1, 2.3.2
All unaffected versions: 2.3.3, 2.4.0, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.2.0, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 6.0.0, 6.1.0