Input validation error in Kotlin Ktor - CVE-2019-12736
Published: November 5, 2019
Vulnerability identifier: #VU22508
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-12736
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: JetBrains s.r.o.
Affected software:
Kotlin Ktor
Kotlin Ktor
Detailed vulnerability description
The vulnerability allows a remote attacker to inject arbitrary commands on the target system.
The vulnerability exists due to the affected software does not sanitize the username provided by the user for the LDAP protocol. A remote attacker can inject arbitrary commands on the target system.
How to mitigate CVE-2019-12736
Install updates from vendor's website.