CVE-2021-41232: falha de alta gravidade em StevenWeathers thunderdome-planning-poker
Improper Neutralization of Special Elements used in an LDAP Query
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar thunderdome-planning-poker+ Monitorar github.com/stevenweathers/thunderdome-planning-poker
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 1.5%
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Produtos afetados
StevenWeathers · thunderdome-planning-poker