Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTgybWcteDU0OC1ncTNq

LDAP Injection in ldapauth

Versions 2.2.4 and earlier of ldapauth-fork are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.

Recommendation

ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use ldapauth-fork 2.3.3 or greater.

Permalink: https://github.com/advisories/GHSA-82mg-x548-gq3j
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTgybWcteDU0OC1ncTNq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00222
EPSS Percentile: 0.60514

Identifiers: GHSA-82mg-x548-gq3j, CVE-2015-7294
References:

• https://github.com/vesse/node-ldapauth-fork/issues/21
• https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4
• https://www.npmjs.com/advisories/18
• https://www.npmjs.com/advisories/19
• http://www.openwall.com/lists/oss-security/2015/09/18/4
• https://nvd.nist.gov/vuln/detail/CVE-2015-7294
• http://www.openwall.com/lists/oss-security/2015/09/18/8
• http://www.openwall.com/lists/oss-security/2015/09/21/2
• https://github.com/advisories/GHSA-82mg-x548-gq3j

Repository: https://github.com/vesse/node-ldapauth-fork
Blast Radius: 23.0

Affected Packages