CVE-2021-41232CWE-74CWE-90

Improper Neutralization of Special Elements used in an LDAP Query

High · published November 2, 2021

CVSS v3.1
8.1
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01516 · 74.3th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2021-11-02T17:55Z
EPSS history
Timeline
  • 02 NOV 17:55Z
    Improper Neutralization of Special Elements used in an LDAP Query
    cvelistv5