Description
ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ldapauth | all versions | — | GHSA-82mg-x548-gq3j |
| npm | ldapauth-fork | < 2.3.3 | 2.3.3 | GHSA-82mg-x548-gq3j |
References
- [oss-security] 20150921 Re: CVE request - ldapauth-fork versions < 2.3.3 are vulnerable to ldap injection. mailing-list
- [oss-security] 20150918 Re: CVE request - ldapauth-fork versions < 2.3.3 are vulnerable to ldap injection. mailing-list
- https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4
- https://github.com/vesse/node-ldapauth-fork/issues/21