Description (CNA)
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| frappe / frappe | affected 0 before 14.99.2; affected 15.0.0 before 15.86.0; unaffected 14.99.2; unaffected 15.86.0 |
CWE
CWE-90
References
- https://github.com/frappe/frappe/security/advisories/GHSA-qrq5-v93p-8xhw
- https://www.vulncheck.com/advisories/frappe-before-15.86.0-ldap-injection-via-unsanitized-endpoint-parameters
ADP enrichment
No English description supplied.
No references supplied.