LDAP Injection in ldapauth

HOCH 7.5CVE-2015-7294 · GHSA-82mg-x548-gq3j · Published 06/09/2017 · updated 17/06/2026

Kurz gesagt

CVE-2015-7294 ist eine Schwachstelle (HOCH (CVSS 7.5)) in ldapauth-fork (ldapauth-fork project), ldapauth, ldapauth-fork.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.1%, höher als bei 82.1% aller Schwachstellen.
Abhilfe: auf 2.3.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
ldapauth-fork ldapauth-fork_project	`< 2.3.3`	`2.3.3`
ldapauth npm	`all versions`	No fix yet
ldapauth-fork npm	`< 2.3.3`	`2.3.3`

Description

Versions 2.2.4 and earlier of ldapauth-fork are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.

Recommendation

ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use ldapauth-fork 2.3.3 or greater.

NVD description

ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.

References

nvd.nist.gov/vuln/detail/CVE-2015-7294 · ADVISORY
vesse/node-ldapauth-fork · WEB
vesse/node-ldapauth-fork commit 3feea43 · WEB
vesse/node-ldapauth-fork · PACKAGE
npmjs.com/advisories/18 · WEB
npmjs.com/advisories/19 · WEB
openwall.com/lists/oss-security/2015/09/18/4 · WEB
openwall.com/lists/oss-security/2015/09/18/8 · WEB
openwall.com/lists/oss-security/2015/09/21/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free