Weaknesses of type CWE-90

78 results

Injeção LDAP

Ocorre quando a aplicação constrói consultas LDAP sem sanitizar adequadamente entradas de usuário, permitindo que um atacante injete caracteres especiais (*, (, ), &, |, etc.) para alterar a lógica da consulta. O resultado é acesso não autorizado a dados do diretório ou bypass de autenticação.

Example

Um formulário de login que monta uma consulta LDAP como `(uid=entrada_usuário)` sem escapar aspas ou asteriscos. Se o usuário digitar `*`, a consulta vira `(uid=*)` e retorna todos os usuários do diretório em vez de validar credenciais.

How to mitigate

Use bibliotecas LDAP que ofereçam encoded parameters ou prepared statements (não concatenação de strings). Sempre escape caracteres especiais LDAP segundo RFC 4515, ou valide/whitelist rigorosamente as entradas antes de montá-las na consulta.

CVE-2026-58222HIGHSamba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesEPSS 0.5%CVE-2026-41919CRITICALApache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN ConstructionEPSS 0.5%CVE-2026-44616MEDIUMApache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter constructionEPSS 0.4%CVE-2025-12764HIGHpgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.EPSS 0.4%CVE-2026-55770MEDIUMOpenBao: LDAPi ldaputil (wrong escape func)EPSS 0.4%CVE-2026-31828MEDIUMParse Server has an LDAP injection via unsanitized user input in DN and group filter constructionEPSS 0.4%CVE-2026-40193HIGHMaddy Mail Server: LDAP Filter Injection via Unsanitized UsernameEPSS 0.4%CVE-2026-34578HIGHOPNsense has an LDAP Injection via Unsanitized Username in AuthenticationEPSS 0.4%CVE-2026-21880MEDIUMKanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information DisclosureEPSS 0.4%CVE-2026-41573HIGHOpenAM LDAP Injection via `_queryId` ParameterEPSS 0.4%CVE-2026-4256HIGHLDAP Injection in PEAKUP's PassGateEPSS 0.4%CVE-2026-39962HIGHLDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variableEPSS 0.3%CVE-2026-81205MEDIUMLDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115EPSS 0.3%CVE-2026-57288LOWJenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativEPSS 0.3%CVE-2026-24130LOWMoonraker with LDAP Enabled Allows Malicious Search Filter InjectionEPSS 0.3%CVE-2025-67493HIGHHomarr: missing input sanitization and possible privilege escalation through ldap search query injectionEPSS 0.3%CVE-2026-19271HIGHBlind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's LiderahenkEPSS 0.3%CVE-2025-35431MEDIUMCISA Thorium LDAP injectionEPSS 0.3%CVE-2026-59652MEDIUMLDAP filter injection in legacy jdk1.4 LDAPStoreHelperEPSS 0.3%CVE-2026-27860LOWIf auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially EPSS 0.3%