Improper Neutralization of Special Elements used in an LDAP Query
CWE-90
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
We track 41 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4.
Latest Improper Neutralization of Special Elements used in an LDAP Query vulnerabilities
- 8.2 High severity
FortiAuthenticator: Improper Neutralization of Special Elements used in an LDAP Query
A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Succe
- 9.9 Critical severity
API Connect: Improper Neutralization of Special Elements used in an LDAP Query
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory
- 8.2 High severity
GitLab: Improper Neutralization of Special Elements used in an LDAP Query
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing
- 8.8 High severity
MOVEit Transfer: Improper Neutralization of Special Elements used in an LDAP Query
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- 8.1 High severity
librenms: Improper Neutralization of Special Elements used in an LDAP Query
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauth
- 9.1 Critical severity
Apache MINA SSHD: Improper Neutralization of Special Elements used in an LDAP Query
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for
- 7.3 High severity
Apache Karaf: Improper Neutralization of Special Elements used in an LDAP Query
LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator
- 7.1 High severity
rabbitmq-server: Improper Neutralization of Special Elements used in an LDAP Query
RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes ${username} into user_dn_pattern w
- 9.3 Critical severity
OpenAM: Improper Neutralization of Special Elements used in an LDAP Query
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-
- 7.1 High severity
OpenAM: Improper Neutralization of Special Elements used in an LDAP Query
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29
- 8.1 High severity
Apache APISIX: Improper Neutralization of Special Elements used in an LDAP Query
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different en
- 7.5 High severity
Liderahenk: Improper Neutralization of Special Elements used in an LDAP Query
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection. This issue affects Liderahenk: from 3.4.0 before 3.5.5.
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Improper Neutralization of Special Elements used in an LDAP Query
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication pl
- 8.8 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Special Elements used in an LDAP Query
A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes
- 8.2 High severity
PassGate: Improper Neutralization of Special Elements used in an LDAP Query
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. This issue affects PassGate: through 30042026.
- 8.8 High severity
Liman MYS: Improper Neutralization of Special Elements used in an LDAP Query
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issue affects Liman MYS: before release.Master.1107.
- 9.1 Critical severity
Apache Shiro: Improper Neutralization of Special Elements used in an LDAP Query
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. T
- 9.8 Critical severity
Apache CXF: Improper Neutralization of Special Elements used in an LDAP Query
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix thi
- 9.1 Critical severity
Apache OFBiz: Improper Neutralization of Special Elements used in an LDAP Query
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
- 7.5 High severity
zitadel: Improper Neutralization of Special Elements used in an LDAP Query
ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating the
- 8.1 High severity
lemur: Improper Neutralization of Special Elements used in an LDAP Query
Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metac
- 8.8 High severity
PAC4J: Improper Neutralization of Special Elements used in an LDAP Query
PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fi
- 8.2 High severity
maddy: Improper Neutralization of Special Elements used in an LDAP Query
maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any L
- 9.6 Critical severity
MISP: Improper Neutralization of Special Elements used in an LDAP Query
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv i
- 8.2 High severity
core: Improper Neutralization of Special Elements used in an LDAP Query
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter
- 7.5 High severity
Secure Email Gateway: Improper Neutralization of Special Elements used in an LDAP Query
SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own.
- 7.5 High severity
Secure Email Gateway: Improper Neutralization of Special Elements used in an LDAP Query
SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to read the contents of emails encrypted for other users.
- 9.8 Critical severity
SuiteCRM: Improper Neutralization of Special Elements used in an LDAP Query
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitize
- 8.8 High severity
parse-server: Improper Neutralization of Special Elements used in an LDAP Query
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) is interpolated direc
- 9.8 Critical severity
WeKan: Improper Neutralization of Special Elements used in an LDAP Query
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP q
- 7.0 High severity
Fireware OS: Improper Neutralization of Special Elements used in an LDAP Query
An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerabilit
- 9.0 Critical severity
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input…
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could im
- 7.5 High severity
pgAdmin 4: Improper Neutralization of Special Elements used in an LDAP Query
pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.
- 8.8 High severity
Apache HertzBeat (incubating): Improper Neutralization of Special Elements used in an LDAP Query
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A succes
- 9.8 Critical severity
Teedy: Improper Neutralization of Special Elements used in an LDAP Query
When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious act
- 7.4 High severity
Mendix LDAP: Improper Neutralization of Special Elements used in an LDAP Query
A vulnerability has been identified in Mendix LDAP (All versions < V1.1.2). Affected versions of the module are vulnerable to LDAP injection. This could allow an unauthenticated remote attacker to bypass username verification.
- 8.1 High severity
glpi: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
- 7.5 High severity
DGX A100: Improper Neutralization of Special Elements in Output Used by a Downstream Component
NVIDIA DGX A100 BMC contains a vulnerability where an attacker may cause an LDAP user injection. A successful exploit of this vulnerability may lead to information disclosure.
- 9.6 Critical severity
OX App Suite: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potential
- 9.8 Critical severity
NxFilter: Improper Neutralization of Special Elements used in an LDAP Query
A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5. This issue affects some unknown processing of the file user,adap.jsp?actionFlag=test&id=1 of the component Bind Request Handler. The manipulation leads to ldap