{"id":"CVE-2021-41232","aliases":["EUVD-2021-2275","GHSA-26cm-qrc6-mfgj","GO-2022-0939"],"status":"published","title":"Improper Neutralization of Special Elements used in an LDAP Query","description":"Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01516,"percentile":0.74858,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-74","CWE-90"],"published":"2021-11-02T17:55:10Z","modified":"2026-10-20T10:53:58Z","fixes":[{"ecosystem":"Go","package":"github.com/stevenweathers/thunderdome-planning-poker","fixed_in":["1.16.3"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/StevenWeathers/thunderdome-planning-poker","fixed_in":["1.16.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/stevenweathers/thunderdome-planning-poker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/stevenweathers/thunderdome-planning-poker","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/StevenWeathers/thunderdome-planning-poker","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.3"}]}]}],"products":[{"vendor":"stevenweathers","product":"thunderdome-planning-poker"},{"vendor":"thunderdome","product":"planning_poker"}],"references":[{"url":"https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgj","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/github/securitylab/issues/464#issuecomment-957094994","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41232","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-26cm-qrc6-mfgj"},{"url":"https://github.com/StevenWeathers/thunderdome-planning-poker","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-41232","title":"Improper Neutralization of Special Elements used in an LDAP Query","description":"Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.","status":"published","published":"2021-11-02T17:55:10Z","modified":"2024-08-04T03:08:31.613Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-90","CWE-74"],"updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-2275","description":"Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.","status":"published","published":"2021-11-02T17:55:10Z","modified":"2024-08-04T03:08:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T03:24:18.784846Z"}],"ghsa":[{"id":"GHSA-26cm-qrc6-mfgj","title":"Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker","description":"### Impact\nLDAP injection vulnerability, only affects instances with LDAP authentication enabled.\n\n### Patches\nPatch for vulnerability released with v1.16.3.\n\n### Workarounds\nDisable LDAP feature if in use\n\n### References\n[OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html\n)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Thunderdome Github Repository](https://github.com/StevenWeathers/thunderdome-planning-poker)\n* Email us at [steven@weathers.me](mailto:steven@weathers.me)\n","status":"published","published":"2021-11-08T18:16:21Z","modified":"2024-02-08T22:24:20Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-74","CWE-90","CWE-116"],"updated_at":"2026-11-02T14:37:36.777238Z"}],"nvd":[{"id":"CVE-2021-41232","description":"Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.","status":"published","published":"2021-11-02T18:15:08.71Z","modified":"2026-06-17T04:08:08.69Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-74","CWE-90","CWE-116"],"updated_at":"2026-11-02T14:07:00.549994Z"}],"osv":[{"id":"CVE-2021-41232","description":"Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.","status":"published","published":"2021-11-02T18:15:08.71Z","modified":"2026-10-20T10:53:58.515018104Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"GHSA-26cm-qrc6-mfgj","title":"Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker","description":"### Impact\nLDAP injection vulnerability, only affects instances with LDAP authentication enabled.\n\n### Patches\nPatch for vulnerability released with v1.16.3.\n\n### Workarounds\nDisable LDAP feature if in use\n\n### References\n[OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html\n)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Thunderdome Github Repository](https://github.com/StevenWeathers/thunderdome-planning-poker)\n* Email us at [steven@weathers.me](mailto:steven@weathers.me)\n","status":"published","published":"2021-11-08T18:16:21Z","modified":"2026-07-08T06:28:28.648407419Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-116","CWE-74","CWE-90"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GO-2022-0939","title":"Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker in github.com/StevenWeathers/thunderdome-planning-poker","description":"Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker in github.com/StevenWeathers/thunderdome-planning-poker","status":"published","published":"2024-08-21T16:03:21Z","modified":"2026-03-03T04:52:30.846304Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}