CVE-2020-5281

MEDIUM

Perun < 3.9.1 - LDAP Injection via ExtSource Configuration

Title source: llm
STIX 2.1

Description

In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.

References (3)

Core 3
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/CESNET/perun/pull/2635

Scores

CVSS v3 6.2
EPSS 0.0133
EPSS Percentile 67.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N

Details

CWE
CWE-90 CWE-732
Status published
Products (1)
cesnet/perun < 3.9.1
Published Mar 25, 2020
Tracked Since Feb 18, 2026