Monthly
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entry to authenticate to the gateway as a different consumer - including entries outside the subtree the plugin was configured to restrict access to. Affected versions span 2.11.0 through 3.17.0, covering several years of releases. No public exploit code or active exploitation has been identified at time of analysis, but the primitive (credential-bearing lateral identity escalation at the API gateway layer) is high-value in multi-tenant or zero-trust deployments.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
LDAP injection in Hyperledger fabric-ca allows unauthenticated network attackers to manipulate LDAP search filters at the CA enrollment endpoint before password validation occurs. Versions 1.5.20 and earlier are affected when the LDAP backend is configured; installations using the default local identity store are not exposed. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but a vendor-released patch is available in version 1.5.21.
LDAP filter injection in Bouncy Castle bc-java before 1.85 allows network-reachable attackers to manipulate LDAP directory search queries by supplying certificates with crafted Subject or Issuer CN values containing LDAP metacharacters. This is a bypass of the CVE-2023-33201 fix: the escaping was applied to the main-Java LDAPStoreHelper and both X509LDAPCertStoreSpi variants, but the jdk1.4 Ant build overlay carries its own private parseDN method that was never patched, leaving bcprov-jdk14 consumers exposed. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
LDAP filter injection in Apache Zeppelin's LdapRealm component allows remote attackers to manipulate LDAP search filter expressions by exploiting a wrong escaping scheme applied to user-supplied input during authentication. Versions 0.11.1, 0.11.2, and 0.12.0 incorrectly apply RFC 4514 distinguished-name escaping - which neutralizes DN metacharacters - instead of RFC 4515 filter-value escaping, leaving LDAP filter metacharacters such as parentheses, asterisks, and backslashes unsanitized in constructed search filters. This is an incomplete fix of CVE-2024-31867; no public exploit has been identified at time of analysis.
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entry to authenticate to the gateway as a different consumer - including entries outside the subtree the plugin was configured to restrict access to. Affected versions span 2.11.0 through 3.17.0, covering several years of releases. No public exploit code or active exploitation has been identified at time of analysis, but the primitive (credential-bearing lateral identity escalation at the API gateway layer) is high-value in multi-tenant or zero-trust deployments.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inject filter metacharacters into LDAP queries when the directory server returns a referral response. Exploitation enables user-existence oracle attacks against the referral Directory Name and can potentially influence which Distinguished Name is used during password binding in multi-domain Active Directory environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-accessible attack vector and lack of authentication requirement elevate practical concern for organizations using LDAP-integrated Quay deployments.
LDAP injection in Hyperledger fabric-ca allows unauthenticated network attackers to manipulate LDAP search filters at the CA enrollment endpoint before password validation occurs. Versions 1.5.20 and earlier are affected when the LDAP backend is configured; installations using the default local identity store are not exposed. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but a vendor-released patch is available in version 1.5.21.
LDAP filter injection in Bouncy Castle bc-java before 1.85 allows network-reachable attackers to manipulate LDAP directory search queries by supplying certificates with crafted Subject or Issuer CN values containing LDAP metacharacters. This is a bypass of the CVE-2023-33201 fix: the escaping was applied to the main-Java LDAPStoreHelper and both X509LDAPCertStoreSpi variants, but the jdk1.4 Ant build overlay carries its own private parseDN method that was never patched, leaving bcprov-jdk14 consumers exposed. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
LDAP filter injection in Apache Zeppelin's LdapRealm component allows remote attackers to manipulate LDAP search filter expressions by exploiting a wrong escaping scheme applied to user-supplied input during authentication. Versions 0.11.1, 0.11.2, and 0.12.0 incorrectly apply RFC 4514 distinguished-name escaping - which neutralizes DN metacharacters - instead of RFC 4515 filter-value escaping, leaving LDAP filter metacharacters such as parentheses, asterisks, and backslashes unsanitized in constructed search filters. This is an incomplete fix of CVE-2024-31867; no public exploit has been identified at time of analysis.