| Package | Affected versions | Patched versions |
|---|---|---|
| snipe-it | < 8.6.3 | 8.6.3 |
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free