CWE-90: LDAP Injection
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an LDAP Query.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- debian linux, fedoraproject fedora, mit kerberos 5 +3 more +5 moreMIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP...3.8 Low
- apache karafModerate severity vulnerability that affects org.apache.karaf:apache-karaf6.5 Medium
- packetfencehtml/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP...9.8 Critical
- vmware vcenter serverVMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle...7.5 High
- joomla joomla\!In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a...9.8 Critical
- ldapauth-fork project ldapauth-forkLDAP Injection in ldapauth7.5 High
- accellion file transfer applianceAn issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier...9.8 Critical
- emc isilon onefsEMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC...6.7 Medium
- jenkins, fedoraproject fedora +1 moreImproper Neutralization of Special Elements used in an LDAP Query in Jenkins9.8 Critical