CWE-90
AllowedImproper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
138 vulnerabilities reference this CWE, most recent first.
GHSA-P4FH-PF6M-QQ74
Vulnerability from github – Published: 2023-01-07 18:30 – Updated: 2023-01-12 21:30A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The name of the patch is a7f7a5a82d9202a5c40d606a5c519ba61b224eb8. It is recommended to upgrade the affected component. VDB-217622 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2015-10027"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-07T17:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The name of the patch is a7f7a5a82d9202a5c40d606a5c519ba61b224eb8. It is recommended to upgrade the affected component. VDB-217622 is the identifier assigned to this vulnerability.",
"id": "GHSA-p4fh-pf6m-qq74",
"modified": "2023-01-12T21:30:29Z",
"published": "2023-01-07T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-10027"
},
{
"type": "WEB",
"url": "https://github.com/hydrian/TTRSS-Auth-LDAP/pull/14"
},
{
"type": "WEB",
"url": "https://github.com/hydrian/TTRSS-Auth-LDAP/commit/a7f7a5a82d9202a5c40d606a5c519ba61b224eb8"
},
{
"type": "WEB",
"url": "https://github.com/hydrian/TTRSS-Auth-LDAP/releases/tag/2.0b1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217622"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217622"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PCVX-8R6M-5H8R
Vulnerability from github – Published: 2025-09-17 18:31 – Updated: 2025-09-17 18:31CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1.
{
"affected": [],
"aliases": [
"CVE-2025-35431"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-17T17:15:43Z",
"severity": "MODERATE"
},
"details": "CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1.",
"id": "GHSA-pcvx-8r6m-5h8r",
"modified": "2025-09-17T18:31:18Z",
"published": "2025-09-17T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35431"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-45e1e58dfb6faacf9efe778c31ead287d8e13ae07c5dad084c792bc4a0605a68R1007-R1008"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/thorium/releases/tag/1.1.1"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35431"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PG32-686Q-QH6X
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-06-29 23:02An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.2.0"
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44930"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-29T23:02:03Z",
"nvd_published_at": "2026-05-22T13:16:22Z",
"severity": "CRITICAL"
},
"details": "An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.\u00a0\nUsers are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.",
"id": "GHSA-pg32-686q-qh6x",
"modified": "2026-06-29T23:02:03Z",
"published": "2026-05-26T13:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44930"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/cxf"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkh"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/22/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache CXF has an LDAP injection vulnerability"
}
GHSA-PM9M-75P4-7H69
Vulnerability from github – Published: 2025-01-30 00:31 – Updated: 2025-02-11 00:31When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.
{
"affected": [],
"aliases": [
"CVE-2024-54852"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-29T22:15:29Z",
"severity": "CRITICAL"
},
"details": "When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.",
"id": "GHSA-pm9m-75p4-7h69",
"modified": "2025-02-11T00:31:47Z",
"published": "2025-01-30T00:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54852"
},
{
"type": "WEB",
"url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PXCQ-C9PX-MH7P
Vulnerability from github – Published: 2026-07-09 15:32 – Updated: 2026-07-09 15:32Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection.
This issue affects PassGate: through 30042026.
{
"affected": [],
"aliases": [
"CVE-2026-4256"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-09T14:16:32Z",
"severity": "HIGH"
},
"details": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection.\n\nThis issue affects PassGate: through 30042026.",
"id": "GHSA-pxcq-c9px-mh7p",
"modified": "2026-07-09T15:32:34Z",
"published": "2026-07-09T15:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4256"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0523"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q6JP-29Q3-RWXV
Vulnerability from github – Published: 2025-09-09 12:30 – Updated: 2025-11-05 00:31Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat .
The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary script execution.
This issue affects Apache HertzBeat: through 1.7.2.
Users are recommended to upgrade to version [1.7.3], which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2025-48208"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-09T10:15:33Z",
"severity": "HIGH"
},
"details": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027) vulnerability in Apache HertzBeat .\n\n\n\n\n\n\n\n\n\n\n\n\nThe attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary script execution.\n\nThis issue affects Apache HertzBeat: through 1.7.2.\n\nUsers are recommended to upgrade to version [1.7.3], which fixes the issue.",
"id": "GHSA-q6jp-29q3-rwxv",
"modified": "2025-11-05T00:31:26Z",
"published": "2025-09-09T12:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48208"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/3zrr3oo67pxxx7wgzj80kglltfshngn2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/09/06/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q8P8-X4X3-FVQM
Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-04-22 15:31Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.
{
"affected": [],
"aliases": [
"CVE-2026-33609"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T14:16:54Z",
"severity": "MODERATE"
},
"details": "Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.",
"id": "GHSA-q8p8-x4x3-fvqm",
"modified": "2026-04-22T15:31:44Z",
"published": "2026-04-22T15:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33609"
},
{
"type": "WEB",
"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QMR3-52XF-WMHX
Vulnerability from github – Published: 2024-04-09 18:30 – Updated: 2024-05-02 14:46Improper Input Validation vulnerability in Apache Zeppelin.
The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.zeppelin:zeppelin-server"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.2"
},
{
"fixed": "0.11.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-31867"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-90"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-10T22:00:52Z",
"nvd_published_at": "2024-04-09T17:16:03Z",
"severity": "MODERATE"
},
"details": "Improper Input Validation vulnerability in Apache Zeppelin.\n\nThe attackers can execute malicious queries by setting improper configuration properties to LDAP search filter.\nThis issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.\n\nUsers are recommended to upgrade to version 0.11.1, which fixes the issue.",
"id": "GHSA-qmr3-52xf-wmhx",
"modified": "2024-05-02T14:46:22Z",
"published": "2024-04-09T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31867"
},
{
"type": "WEB",
"url": "https://github.com/apache/zeppelin/pull/4714"
},
{
"type": "WEB",
"url": "https://github.com/apache/zeppelin/commit/65d0bcc1ee8ec3ec372d0a71ab513cd20e6522a0"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/zeppelin"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/04/09/12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Zeppelin: LDAP search filter query Injection Vulnerability"
}
GHSA-QW6J-957M-52HG
Vulnerability from github – Published: 2025-04-07 15:31 – Updated: 2025-04-07 15:31Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
{
"affected": [],
"aliases": [
"CVE-2025-27686"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-07T14:15:24Z",
"severity": "LOW"
},
"details": "Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.",
"id": "GHSA-qw6j-957m-52hg",
"modified": "2025-04-07T15:31:21Z",
"published": "2025-04-07T15:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27686"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-ao/000302223/dsa-2025-111-dell-powermaxos-dell-powermax-eem-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-unisphere-360-dell-solutions-enabler-and-dell-solutions-enabler-virtual-appliance-security-update-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R7MX-568F-JGG3
Vulnerability from github – Published: 2026-07-31 12:30 – Updated: 2026-08-18 15:31A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
{
"affected": [],
"aliases": [
"CVE-2026-11770"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-31T10:16:44Z",
"severity": "HIGH"
},
"details": "A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.",
"id": "GHSA-r7mx-568f-jgg3",
"modified": "2026-08-18T15:31:17Z",
"published": "2026-07-31T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11770"
},
{
"type": "WEB",
"url": "https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/repl_extop.c"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484802"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-11770"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56050"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56048"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56047"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55794"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55758"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55757"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55756"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55532"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55530"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55426"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55425"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55424"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55423"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55422"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55421"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
CAPEC-136: LDAP Injection
An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.