PT-2021-23204 · Unknown · Thunderdome

Pupiles · Published 2021-11-02 · Updated 2024-08-21 · CVE-2021-41232

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thunderdome versions prior to 1.16.3

Description The issue is related to an LDAP injection vulnerability that affects instances with LDAP authentication enabled. The provided username is not properly escaped, allowing for potential exploitation. This issue has been patched, and it is estimated that a significant number of devices worldwide that use Thunderdome with LDAP authentication could be affected, although the exact number is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions prior to 1.16.3, update to version 1.16.3 to resolve the issue. As a temporary workaround, consider disabling the LDAP feature if it is in use, to minimize the risk of exploitation.

Fix

Special Elements Injection

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-90

CWE-74

CWE-116

Related Identifiers

CVE-2021-41232

GHSA-26CM-QRC6-MFGJ

GO-2022-0939

Affected Products

Thunderdome

References · 8

• https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1 · Patch
• https://osv.dev/vulnerability/CVE-2021-41232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41232 · Security Note
• https://osv.dev/vulnerability/GHSA-26cm-qrc6-mfgj · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0939 · Vendor Advisory
• https://github.com/github/securitylab/issues/464#issuecomment-957094994 · Note
• https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgj · Note
• https://github.com/StevenWeathers/thunderdome-planning-poker · Note