LDAP Injection in ldapauth

ALTO 7.5CVE-2015-7294 · GHSA-82mg-x548-gq3j · Published 06/09/2017 · updated 17/06/2026

En resumen

CVE-2015-7294 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a ldapauth-fork (ldapauth-fork project), ldapauth, ldapauth-fork.
Probabilidad de explotación en los próximos 30 días (EPSS): 2.1%, mayor que el 82.1% de las vulnerabilidades.
Solución: actualizar a 2.3.3 o posterior.

Package	Affected versions	Patched versions
ldapauth-fork ldapauth-fork_project	`< 2.3.3`	`2.3.3`
ldapauth npm	`all versions`	No fix yet
ldapauth-fork npm	`< 2.3.3`	`2.3.3`

Description

Versions 2.2.4 and earlier of ldapauth-fork are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.

Recommendation

ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use ldapauth-fork 2.3.3 or greater.

NVD description

ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.

References

nvd.nist.gov/vuln/detail/CVE-2015-7294 · ADVISORY
vesse/node-ldapauth-fork · WEB
vesse/node-ldapauth-fork commit 3feea43 · WEB
vesse/node-ldapauth-fork · PACKAGE
npmjs.com/advisories/18 · WEB
npmjs.com/advisories/19 · WEB
openwall.com/lists/oss-security/2015/09/18/4 · WEB
openwall.com/lists/oss-security/2015/09/18/8 · WEB
openwall.com/lists/oss-security/2015/09/21/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free