CVE-2026-110256: falha de média gravidade em Finsys dockhand
Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.4%
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Finsys · dockhandCVEs relacionadas — Finsys dockhand
No mesmo produto, das mais perigosas para as menos.
CVE-2026-110130CRITICALDockhand before 1.0.45 Authentication Bypass via Static-Asset CheckEPSS 0.7%CVE-2026-121448HIGHDockhand before 1.0.54 Path Traversal via Stack Environment RoutesEPSS 0.5%CVE-2026-53988CRITICALDockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook EndpointsEPSS 0.5%CVE-2026-121449HIGHDockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookEPSS 0.4%CVE-2026-110112CRITICALDockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim ValidationEPSS 0.4%CVE-2026-113354HIGHDockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentEPSS 0.4%