CVE-2025-35431CWE-90

CISA Thorium LDAP injection

Medium · published September 17, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00310 · 22.6th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2025-09-17T16:52Z
EPSS history
Timeline
  • 17 SEP 16:52Z
    CISA Thorium LDAP injection
    cvelistv5