PT-2025-3081 · Teedy · Teedy

Sopalinge · Published 2025-01-29 · Updated 2025-05-24 · CVE-2024-54852

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Teedy versions 1.9 through 1.12

Description The issue arises when the LDAP connection is activated, allowing an unauthenticated attacker to exploit the username field of the login form due to improper sanitization of user input. This enables the attacker to perform malicious actions, such as creating arbitrary accounts and spraying passwords.

Recommendations Teedy versions 1.9 through 1.12: Update the LDAP connection settings to properly sanitize user input, specifically the username field, to prevent LDAP injection attacks. Ensure that all user input is validated and sanitized before being processed by the LDAP connection.

Exploit

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2024-54852

Affected Products

Teedy

References · 7

• 🔥 https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-54852 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54852 · Security Note
• https://t.me/cvenotify/123519 · Telegram Post
• https://twitter.com/CVEnew/status/1884717271634923799 · Twitter Post
• https://t.me/cvedetector/16720 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1884748574480630212 · Twitter Post