CVE-2023-0476

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users

Medium · published January 25, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00693 · 52.3th percentile
Published
2023-01-25T00:00Z
EPSS history
Timeline
  • 25 JAN 00:00Z
    A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users
    cvelistv5