CVE-2021-32651: falha de baixa gravidade em theonedev onedev
LDAP injection via OneDev may leak some LDAP directory information
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.1epss 1.1%
OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
theonedev · onedevCVEs relacionadas — theonedev onedev
No mesmo produto, das mais perigosas para as menos.
CVE-2021-21242CRITICALPre-Auth Unsafe Deserialization on AttachmentUploadServetEPSS 74.2%CVE-2021-21243CRITICALPre-Auth Unsafe Deserialization on KubernetesResourceEPSS 54.5%CVE-2021-21246HIGHPre-Auth Access token leakEPSS 49.1%CVE-2024-45309HIGHOneDev vulnerable to arbitrary file reading for unauthenticated userEPSS 24.5%CVE-2021-21251HIGHZipSlip Arbitrary File UploadEPSS 12.7%CVE-2021-21249CRITICALPost-Auth Unsafe Yaml deserializationEPSS 3.1%