Description (CNA)
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP queries during authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WeKan / WeKan | affected 0 before 8.19 |
CWE
CWE-90
References
- https://github.com/wekan/wekan/commit/0b0e16c3eae28bbf453d33a81a9c58ce7db6d5bb
- https://wekan.fi/
- https://www.vulncheck.com/advisories/wekan-ldap-authentication-filter-injection
ADP enrichment
No English description supplied.
No references supplied.