Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 1.3%
probabilidade de exploração
1.3%top 33% das CVEs
exploração observada
nãonenhuma fonte reporta
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection attack to leak arbitrary attributes from LDAP database. This issue is fixed in versions 3.5.8, 4.0.4, and 4.1.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
mastodon · mastodonReferências
https://github.com/mastodon/mastodon/blob/94cbd808b5b3e7999c7e77dc724b7e8c9dd2bdec/app/models/concerns/ldap_authenticable.rb#L7-L14https://github.com/mastodon/mastodon/blob/94cbd808b5b3e7999c7e77dc724b7e8c9dd2bdec/config/initializers/devise.rb#L398-L414https://github.com/mastodon/mastodon/pull/24379https://github.com/mastodon/mastodon/releases/tag/v3.5.8https://github.com/mastodon/mastodon/releases/tag/v4.0.4https://github.com/mastodon/mastodon/releases/tag/v4.1.2https://github.com/mastodon/mastodon/security/advisories/GHSA-38g9-pfm9-gfqvhttp://www.openwall.com/lists/oss-security/2023/07/06/6