Fallos del tipo CWE-90

78 resultados

Injeção LDAP

Ocorre quando uma aplicação constrói uma consulta LDAP incluindo entrada do usuário sem sanitização adequada. Um atacante pode injetar caracteres e sintaxe LDAP especiais para modificar a lógica da consulta, contornando autenticação, extraindo dados não autorizados ou alterando estruturas de diretório.

Ejemplo

Um formulário de login que monta a query como `(uid=*)(|(uid=admin` sem escapar caracteres especiais. Um atacante entra `*)(|(uid=` no campo de usuário, alterando a consulta para sempre retornar verdadeiro e ganhando acesso de admin.

Cómo mitigar

Use funções nativas de escape LDAP da sua linguagem ou biblioteca (como `LdapName` em Java, ou filtros parametrizados quando disponíveis). Valide e liste permissões de entrada esperada — caracteres como `*`, `(`, `)`, `\` e nulo devem ser bloqueados ou escapados rigorosamente.

CVE-2026-58222HIGHSamba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesEPSS 0.5%CVE-2026-41919CRITICALApache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN ConstructionEPSS 0.5%CVE-2026-44616MEDIUMApache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter constructionEPSS 0.4%CVE-2025-12764HIGHpgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.EPSS 0.4%CVE-2026-55770MEDIUMOpenBao: LDAPi ldaputil (wrong escape func)EPSS 0.4%CVE-2026-31828MEDIUMParse Server has an LDAP injection via unsanitized user input in DN and group filter constructionEPSS 0.4%CVE-2026-40193HIGHMaddy Mail Server: LDAP Filter Injection via Unsanitized UsernameEPSS 0.4%CVE-2026-34578HIGHOPNsense has an LDAP Injection via Unsanitized Username in AuthenticationEPSS 0.4%CVE-2026-21880MEDIUMKanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information DisclosureEPSS 0.4%CVE-2026-41573HIGHOpenAM LDAP Injection via `_queryId` ParameterEPSS 0.4%CVE-2026-4256HIGHLDAP Injection in PEAKUP's PassGateEPSS 0.4%CVE-2026-39962HIGHLDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variableEPSS 0.3%CVE-2026-81205MEDIUMLDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115EPSS 0.3%CVE-2026-57288LOWJenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativEPSS 0.3%CVE-2026-24130LOWMoonraker with LDAP Enabled Allows Malicious Search Filter InjectionEPSS 0.3%CVE-2025-67493HIGHHomarr: missing input sanitization and possible privilege escalation through ldap search query injectionEPSS 0.3%CVE-2026-19271HIGHBlind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's LiderahenkEPSS 0.3%CVE-2025-35431MEDIUMCISA Thorium LDAP injectionEPSS 0.3%CVE-2026-59652MEDIUMLDAP filter injection in legacy jdk1.4 LDAPStoreHelperEPSS 0.3%CVE-2026-27860LOWIf auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially EPSS 0.3%