CWE-90: LDAP Injection
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an LDAP Query.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 4.8 Medium
- seppmail ag secure email gateway (seg) LDAP wildcard injection exposes GINA recipient accounts 6.9 Medium
- synacor zimbra collaboration suite, zimbra collaboration suite +1 more Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name 4.3 Medium
- gitlab Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab 8.2 High
- zimbra collaboration suite Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution 5.3 Medium
- progress moveit transfer MOVEit Transfer LDAP injection in certificate-based authentication 7.5 High
- finsys dockhand Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth 6.3 Medium
- esri portal for arcgis BUG-000171040 Portal for ArcGIS has a security vulnerability 5.5 Medium
- elated-themes frappe Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters 6.3 Medium
- librenms LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header 9.2 Critical
- apache software foundation mina sshd Apache MINA SSHD: LDAP injection in sshd-ldap 9.1 Critical
- eleveo call recording software Eleveo Call Recording Software User Management userAddAction.do ldap injection 5.3 Medium
- apache karaf Apache Karaf: LDAP filter injection in JAAS LDAP login modules 7.3 High
- glpi-project glpi GLPI: LDAP filter injection in user import feature 4.6 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: LDAP DN injection via unescaped substitution 6.3 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 4.4 Medium
- okta access gateway Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation 6.8 Medium
- apache apisix Apache APISIX: ldap-auth plugin cross-subtree identity impersonation 7.0 High
- drupal ldap / active directory integration, miniorange ldap \/ active directory integration +1 more LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115 5.3 Medium
- tubitak bilgem software technologies research institute liderahenk Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk 7.5 High
- splunk ad ldap app for splunk soar Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR 5.4 Medium
- dolibarr Dolibarr User Cloning card.php ldap injection 5.3 Medium
- redhat quay, red hat openshift update service, quay 3 +2 more Quay: ldap referral filter injection in quay external ldap authentication 4.8 Medium
- hyperledger fabric-ca Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter 6.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +5 more +7 more Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary 5.4 Medium
- bouncycastle bc-java LDAP filter injection in legacy jdk1.4 LDAPStoreHelper 6.9 Medium
- redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check 7.5 High
- apache zeppelin Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 6.5 Medium
- apache zeppelin Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction 6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 more Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes 8.8 High
- peakup technology inc. passgate LDAP Injection in PEAKUP's PassGate 8.2 High
- havelsan liman mys LDAP Injection in HAVELSAN's Liman MYS 8.8 High
- openidentityplatform openam OpenAM Authentication Bypass via MSISDN LDAP Injection 9.3 Critical
- jenkins active directory, jenkins project active directory plugin +1 more Jenkins Active Directory Plugin has an LDAP injection vulnerability 3.7 Low
- openidentityplatform openam OpenAM LDAP Injection via `_queryId` Parameter 7.1 High
- line corporation central dogma Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion 6.9 Medium
- openbao OpenBao: LDAPi ldaputil (wrong escape func) 6.8 Medium
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more ASP.NET Core Elevation of Privilege Vulnerability 8.8 High
- apache shiro Apache Shiro: LDAP DN Injection in DefaultLdapRealm 8.8 High
- roxy-wi Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only) 4.9 Medium
- yamcs Yamcs Vulnerable to LDAP Injection in LdapAuthModule 4.3 Medium
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token 5.3 Medium
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +1 more +3 more Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository 9.8 Critical
- netatalk LDAP filter injection 4.2 Medium
- apache ofbiz Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction 9.1 Critical
- zitadel ZITADEL: LDAP Filter Injection in Login Flow 7.5 High
- netflix lemur Lemur: LDAP Filter Injection enables post-authentication privilege escalation 8.1 High
- powerdns authoritative LDAP DN injection 5.3 Medium
- Show olderLoading…