{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2022-45910", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "requesterUserId": "cf81350d-439c-4450-9d42-0a054bb6b6c9", "dateReserved": "2022-11-26T16:22:46.368Z", "datePublished": "2022-12-07T09:50:52.700Z", "dateUpdated": "2022-12-07T09:53:12.935Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache ManifoldCF", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.23", "status": "affected", "version": "0", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "finder", "value": "4ra1n of Chaitin Tech"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries (DoS, additional queries, filter manipulation) during user lookup, if the username or the domain string are passed to the UserACLs servlet without validation.<br><br>This issue affects Apache ManifoldCF version 2.23 and prior versions."}], "value": "Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries (DoS, additional queries, filter manipulation) during user lookup, if the username or the domain string are passed to the UserACLs servlet without validation.\n\nThis issue affects Apache ManifoldCF version 2.23 and prior versions."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-90", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2022-12-07T09:53:12.935Z"}, "references": [{"tags": ["mailing-list", "vendor-advisory"], "url": "https://lists.apache.org/thread/m693p0dq6jvwwvmy2wnhj6k854z0s444"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:manifoldcf:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D1D815E-3266-49FA-AE97-FDB9996547EE", "versionEndIncluding": "2.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries (DoS, additional queries, filter manipulation) during user lookup, if the username or the domain string are passed to the UserACLs servlet without validation.\n\nThis issue affects Apache ManifoldCF version 2.23 and prior versions."}, {"lang": "es", "value": "La neutralizaci\u00f3n incorrecta de elementos especiales utilizados en una vulnerabilidad de consulta LDAP ('Inyecci\u00f3n LDAP') en los conectores de autoridad ActiveDirectory y Sharepoint ActiveDirectory de Apache ManifoldCF permite a un atacante manipular las consultas de b\u00fasqueda LDAP (DoS, consultas adicionales, manipulaci\u00f3n de filtros) durante la b\u00fasqueda del usuario, si el nombre de usuario o la cadena de dominio se pasan al servlet UserACL sin validaci\u00f3n. Este problema afecta a Apache ManifoldCF versi\u00f3n 2.23 y versiones anteriores."}], "id": "CVE-2022-45910", "lastModified": "2023-11-07T03:54:57.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-07T10:15:11.217", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/m693p0dq6jvwwvmy2wnhj6k854z0s444"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-90"}], "source": "security@apache.org", "type": "Secondary"}]}

{}