CVE-2021-32651

OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2.
Configurations

Configuration 1 (hide)

cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*

History

16 Jun 2021, 14:28

Type Values Removed Values Added
CPE cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*
CWE CWE-90
CVSS v2 : unknown
v3 : unknown
v2 : 4.3
v3 : 4.3
References (CONFIRM) https://github.com/theonedev/onedev/security/advisories/GHSA-5864-2496-4xjf - (CONFIRM) https://github.com/theonedev/onedev/security/advisories/GHSA-5864-2496-4xjf - Exploit, Third Party Advisory
References (MISC) https://github.com/theonedev/onedev/commit/4440f0c57e440488d7e653417b2547eaae8ad19c - (MISC) https://github.com/theonedev/onedev/commit/4440f0c57e440488d7e653417b2547eaae8ad19c - Patch, Third Party Advisory

01 Jun 2021, 18:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-06-01 18:15

Updated : 2024-02-04 21:47


NVD link : CVE-2021-32651

Mitre link : CVE-2021-32651

CVE.ORG link : CVE-2021-32651


JSON object : View

Products Affected

onedev_project

  • onedev
CWE
CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')