LDAP injection via OneDev may leak some LDAP directory information
CVE-2021-32651

3.1LOW

Key Information:

Vendor

Theonedev

Status
Onedev
Vendor
CVE Published:
1 June 2021

What is CVE-2021-32651?

OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2.

Affected Version(s)

onedev <= 4.4.1

References

https://github.com/theonedev/onedev/security/advisories/G...
x_refsource_CONFIRM
https://github.com/theonedev/onedev/commit/4440f0c57e4404...
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.