CVE-2020-5281

LDAP connector injection in Perun

State: Published
Severity: 6.2 Medium
Published: Mar 25, 2020
Updated: Aug 4, 2024
Reserved: Jan 2, 2020

Description

In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.

Scores

CVSS	Score	Vector	Source
3.1	6.2 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N	GitHub_M

Weaknesses

CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Affected Products

Product	Versions
perunCESNET	< 3.9.1Affected

References

https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3
https://github.com/CESNET/perun/pull/2635
https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.