LDAP injection in Apache Camel - CVE-2022-45046
Published: December 5, 2022
Vulnerability identifier: #VU69912
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-45046
CWE-ID: CWE-90
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper input validation when processing DLAP queries. A remote non-authenticated attacker can send a specially crafted LDAP query via the filter option to the application, bypass authentication process and gain unauthorized access to the application.
Affected software
Apache Camel
IBM Data Risk Manager
IBM Data Risk Manager
How to mitigate CVE-2022-45046
Install updates from vendor's website.
Apache Camel - addressed in versions 3.14.6, 3.18.4
IBM Data Risk Manager - update to 2.0.6.16
IBM Data Risk Manager - update to 2.0.6.16