Kritik CVSS 9.8 PoC var
CVE-2022-29155: Openldap: SQL enjeksiyonu
Açıklama (NVD)
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.
Özet bilgiler
- Ürün
- Openldap Openldap
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %64,49 (yüzdelik 99)
- CWE
- CWE-89
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| openldap-openldap | 2.0 | — | 2.5.12 |
| openldap-openldap | 2.6.0 | — | 2.6.2 |
| debian-debian-linux | 9.0 | 9.0 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |
| netapp-h300s-firmware | — | — | — |
| netapp-h500s-firmware | — | — | — |
| netapp-h700s-firmware | — | — | — |
| netapp-h700e-firmware | — | — | — |
| netapp-h410s-firmware | — | — | — |
| netapp-h410c-firmware | — | — | — |