Falhas do tipo CWE-90

78 resultados

Injeção LDAP

Ocorre quando a aplicação constrói consultas LDAP concatenando entrada do usuário sem sanitização, permitindo que um atacante insira caracteres especiais (como `*`, `(`, `)`) para alterar a lógica da busca. Um filtro LDAP mal tratado pode expor dados sensíveis do diretório ou contornar autenticação.

Exemplo

Uma aplicação monta um filtro como `(&(uid=*)(password=INPUT))` onde INPUT vem diretamente do formulário. Se o usuário envia `*))(&(uid=*`, o filtro vira `(&(uid=*)(password=*))(&(uid=*`, retornando qualquer usuário com qualquer senha.

Como mitigar

Use bibliotecas que ofereçam construção segura de filtros LDAP (encoding de caracteres especiais) ou prepared statements equivalentes; nunca concatene strings diretas em filtros. Valide e sanitize entradas segundo o escopo esperado (ex: apenas alfanuméricos para username).

CVE-2026-58222HIGHSamba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesEPSS 0.5%CVE-2026-41919CRITICALApache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN ConstructionEPSS 0.5%CVE-2026-44616MEDIUMApache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter constructionEPSS 0.4%CVE-2025-12764HIGHpgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.EPSS 0.4%CVE-2026-55770MEDIUMOpenBao: LDAPi ldaputil (wrong escape func)EPSS 0.4%CVE-2026-31828MEDIUMParse Server has an LDAP injection via unsanitized user input in DN and group filter constructionEPSS 0.4%CVE-2026-40193HIGHMaddy Mail Server: LDAP Filter Injection via Unsanitized UsernameEPSS 0.4%CVE-2026-34578HIGHOPNsense has an LDAP Injection via Unsanitized Username in AuthenticationEPSS 0.4%CVE-2026-21880MEDIUMKanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information DisclosureEPSS 0.4%CVE-2026-41573HIGHOpenAM LDAP Injection via `_queryId` ParameterEPSS 0.4%CVE-2026-4256HIGHLDAP Injection in PEAKUP's PassGateEPSS 0.4%CVE-2026-39962HIGHLDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variableEPSS 0.3%CVE-2026-81205MEDIUMLDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115EPSS 0.3%CVE-2026-57288LOWJenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativEPSS 0.3%CVE-2026-24130LOWMoonraker with LDAP Enabled Allows Malicious Search Filter InjectionEPSS 0.3%CVE-2025-67493HIGHHomarr: missing input sanitization and possible privilege escalation through ldap search query injectionEPSS 0.3%CVE-2026-19271HIGHBlind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's LiderahenkEPSS 0.3%CVE-2025-35431MEDIUMCISA Thorium LDAP injectionEPSS 0.3%CVE-2026-59652MEDIUMLDAP filter injection in legacy jdk1.4 LDAPStoreHelperEPSS 0.3%CVE-2026-27860LOWIf auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially EPSS 0.3%