PT-2023-10206 · Hydrian · Ttrss-Auth-Ldap

14Hydrian · Published 2023-01-07 · Updated 2024-05-17 · CVE-2015-10027

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:A/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions hydrian TTRSS-Auth-LDAP versions prior to 2.0b1

Description A problematic issue has been found in the Username Handler component, leading to ldap injection. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. The manipulation of the username variable can lead to ldap injection.

Recommendations For versions prior to 2.0b1, upgrade to version 2.0b1 to address this issue. As a temporary workaround, consider restricting the use of the Username Handler component until a patch is applied.

Fix

Special Elements Injection

Weakness Enumeration

CWE-90

CWE-74

Related Identifiers

CVE-2015-10027

Affected Products

Ttrss-Auth-Ldap

References · 8

• https://github.com/hydrian/TTRSS-Auth-LDAP/releases/tag/2.0b1 · Patch
• https://github.com/hydrian/TTRSS-Auth-LDAP/pull/14 · Patch
• https://github.com/hydrian/TTRSS-Auth-LDAP/commit/a7f7a5a82d9202a5c40d606a5c519ba61b224eb8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10027 · Security Note
• https://t.me/cvenotify/41495 · Telegram Post
• https://vuldb.com/?ctiid.217622 · Note
• https://vuldb.com/?id.217622 · Note
• https://t.me/cvenotify/41871 · Telegram Post