What is GHSA-26cm-qrc6-mfgj?

GHSA-26cm-qrc6-mfgj is a security advisory published by GitHub Security Advisories with High severity. Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

Which CVE IDs does GHSA-26cm-qrc6-mfgj cover?

GHSA-26cm-qrc6-mfgj covers the following CVE IDs: CVE-2021-41232. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-26cm-qrc6-mfgj?

GHSA-26cm-qrc6-mfgj has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-26cm-qrc6-mfgj?

GHSA-26cm-qrc6-mfgj affects 1 product, including: go/github.com/stevenweathers/thunderdome-planning-poker:\u003c 1.16.3.

GHSA-26cm-qrc6-mfgjHighCVSS 8.1

Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

Vendor

GitHub Security Advisories

Published

November 8, 2021

Last Modified

February 8, 2024

🔗 CVE IDs covered (1)

CVE-2021-41232 →

📋 Description

Impact

LDAP injection vulnerability, only affects instances with LDAP authentication enabled.

Patches

Patch for vulnerability released with v1.16.3.

Workarounds

Disable LDAP feature if in use

References

OWASP LDAP Injection Prevention Cheat Sheet

For more information

If you have any questions or comments about this advisory:

Open an issue in Thunderdome Github Repository
Email us at [email protected]

🎯 Affected products1

go/github.com/stevenweathers/thunderdome-planning-poker:< 1.16.3

🔗 References (5)

https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgj
https://nvd.nist.gov/vuln/detail/CVE-2021-41232
https://github.com/github/securitylab/issues/464#issuecomment-957094994
https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1
https://github.com/advisories/GHSA-26cm-qrc6-mfgj