In short
- CVE-2021-41232 is a CRITICAL (CVSS 9.8) vulnerability affecting github.com/StevenWeathers/thunderdome-planning-poker, github.com/stevenweathers/thunderdome-planning-poker, planning poker (thunderdome).
- Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.7% of all vulnerabilities.
- Fix: update to 1.16.3 or later.
Description
Impact
LDAP injection vulnerability, only affects instances with LDAP authentication enabled.
Patches
Patch for vulnerability released with v1.16.3.
Workarounds
Disable LDAP feature if in use
References
OWASP LDAP Injection Prevention Cheat Sheet
For more information
If you have any questions or comments about this advisory:
NVD description
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free