Unscored CVE-2021-3027 EUVD-2021-26380GHSA-32jf-8hmq-3gv8

app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting…

Published Mar 26, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Description

app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization.

References

https://jorgectf.gitlab.io/disclosure/cve-2021-3027/
https://github.com/LibrIT/passhport/pull/562
https://github.com/LibrIT/passhport/commit/366b03f607729c4538e91b634ecc57c8398522a1