SB2022120649 - LDAP injection in Apache ManifoldCF
Published: December 6, 2022
Security Bulletin ID
SB2022120649
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) LDAP injection (CVE-ID: CVE-2022-45910)
The vulnerability allows a remote user to manipulate queries and escalate privileges within the application.
The vulnerability exists due to improper input validation when processing DLAP queries within the ActiveDirectory and Sharepoint ActiveDirectory authority connectors. A remote user can send a specially crafted LDAP query to the application and bypass implemented security restrictions or escalate privileges within the application.
Remediation
Install update from vendor's website.