PT-2023-10206 · Hydrian · Ttrss-Auth-Ldap

14Hydrian · Publicado 2023-01-07 · Atualizado 2024-05-17 · CVE-2015-10027

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:A/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions hydrian TTRSS-Auth-LDAP versions prior to 2.0b1

Description A problematic issue has been found in the Username Handler component, leading to ldap injection. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. The manipulation of the username variable can lead to ldap injection.

Recommendations For versions prior to 2.0b1, upgrade to version 2.0b1 to address this issue. As a temporary workaround, consider restricting the use of the Username Handler component until a patch is applied.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-90

CWE-74

Identificadores relacionados

CVE-2015-10027

Produtos afetados

Ttrss-Auth-Ldap

Referências · 8

• https://github.com/hydrian/TTRSS-Auth-LDAP/releases/tag/2.0b1 · Correção
• https://github.com/hydrian/TTRSS-Auth-LDAP/pull/14 · Correção
• https://github.com/hydrian/TTRSS-Auth-LDAP/commit/a7f7a5a82d9202a5c40d606a5c519ba61b224eb8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-10027 · Nota de Segurança
• https://t.me/cvenotify/41495 · Publicação no Telegram
• https://vuldb.com/?ctiid.217622 · Nota
• https://vuldb.com/?id.217622 · Nota
• https://t.me/cvenotify/41871 · Publicação no Telegram