CVE-2021-3027

EUVD-2021-26380
app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
libritpasshport
𝑥
≤ 2.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/LibrIT/passhport/commit/366b03f607729c4538e91b634ecc57c8398522a1
https://github.com/LibrIT/passhport/pull/562
https://jorgectf.gitlab.io/disclosure/cve-2021-3027/
https://github.com/LibrIT/passhport/commit/366b03f607729c4538e91b634ecc57c8398522a1
https://github.com/LibrIT/passhport/pull/562
https://jorgectf.gitlab.io/disclosure/cve-2021-3027/