CVE-2021-41232
In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.52% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-90, CWE-116
- Affected
- thunderdome/planning poker
- Source
- security-advisories@github.com
References
- https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1Patch
- https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgjThird Party Advisory
- https://github.com/github/securitylab/issues/464#issuecomment-957094994Issue Tracking, Third Party Advisory
- https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1Patch
- https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgjThird Party Advisory
- https://github.com/github/securitylab/issues/464#issuecomment-957094994Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.