Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

심각 9.8CVE-2021-41232 · GHSA-26cm-qrc6-mfgj · GO-2022-0939 · Published 02/11/2021 · updated 17/06/2026

요약

CVE-2021-41232은(는) github.com/StevenWeathers/thunderdome-planning-poker, github.com/stevenweathers/thunderdome-planning-poker, planning poker (thunderdome)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.5%, 전체 취약점의 74.7%보다 높음.
조치: 1.16.3 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
github.com/StevenWeathers/thunderdome-planning-poker Go	`< 1.16.3`	`1.16.3`
github.com/stevenweathers/thunderdome-planning-poker Go	`< 1.16.3`	`1.16.3`
planning poker thunderdome	`< 1.16.3`	`1.16.3`

Description

Impact

LDAP injection vulnerability, only affects instances with LDAP authentication enabled.

Patches

Patch for vulnerability released with v1.16.3.

Workarounds

Disable LDAP feature if in use

References

OWASP LDAP Injection Prevention Cheat Sheet

For more information

If you have any questions or comments about this advisory:

Open an issue in Thunderdome Github Repository
Email us at [email protected]

NVD description

Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.

References

StevenWeathers/thunderdome-planning-poker security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-41232 · ADVISORY
github/securitylab · WEB
StevenWeathers/thunderdome-planning-poker commit f1524d0 · WEB
StevenWeathers/thunderdome-planning-poker · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

요약

CVE-2021-41232은(는) github.com/StevenWeathers/thunderdome-planning-poker, github.com/stevenweathers/thunderdome-planning-poker, planning poker (thunderdome)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.

향후 30일 내 악용 확률(EPSS): 1.5%, 전체 취약점의 74.7%보다 높음.

조치: 1.16.3 이상으로 업데이트하세요.

Package

Affected versions

Patched versions

github.com/StevenWeathers/thunderdome-planning-poker

< 1.16.3

1.16.3

github.com/stevenweathers/thunderdome-planning-poker

< 1.16.3

1.16.3

planning poker

thunderdome

< 1.16.3

1.16.3

Description

Impact

LDAP injection vulnerability, only affects instances with LDAP authentication enabled.

Patches

Patch for vulnerability released with v1.16.3.

Workarounds

Disable LDAP feature if in use

References

OWASP LDAP Injection Prevention Cheat Sheet

For more information

If you have any questions or comments about this advisory:

Open an issue in Thunderdome Github Repository
Email us at [email protected]

NVD description