Search criteria

3 vulnerabilities found for perun by CESNET

FKIE_CVE-2020-5281

Vulnerability from fkie_nvd - Published: 2020-03-25 18:15 - Updated: 2024-11-21 05:33
Severity ?
6.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.
References
security-advisories@github.comhttps://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/CESNET/perun/pull/2635Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/CESNET/perun/pull/2635Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3Third Party Advisory
Impacted products
Vendor Product Version
cesnet perun *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cesnet:perun:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C41BD02A-99DF-4490-B354-9E883FF818DB",
              "versionEndExcluding": "3.9.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input."
    },
    {
      "lang": "es",
      "value": "En Perun versiones anteriores a 3.9.1, VO o el administrador de grupo pueden modificar la configuraci\u00f3n de LDAP extSource para recuperar todo desde Perun LDAP. El problema es corregido en la versi\u00f3n 3.9.1, mediante el saneamiento de la entrada."
    }
  ],
  "id": "CVE-2020-5281",
  "lastModified": "2024-11-21T05:33:49.663",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-03-25T18:15:14.343",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/perun/pull/2635"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/perun/pull/2635"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-90"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2020-5281 (GCVE-0-2020-5281)

Vulnerability from cvelistv5 – Published: 2020-03-25 18:00 – Updated: 2024-08-04 08:22
VLAI?
Summary
In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.
Severity ?
6.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N
CWE
  • CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Assigner
References
Impacted products
Vendor Product Version
CESNET perun Affected: < 3.9.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:22:09.083Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/perun/pull/2635"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "perun",
          "vendor": "CESNET",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-90",
              "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-25T18:00:20",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CESNET/perun/pull/2635"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039"
        }
      ],
      "source": {
        "advisory": "GHSA-gj88-9q3f-72m3",
        "discovery": "UNKNOWN"
      },
      "title": "LDAP connector injection in Perun",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-5281",
          "STATE": "PUBLIC",
          "TITLE": "LDAP connector injection in Perun"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "perun",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "CESNET"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3",
              "refsource": "CONFIRM",
              "url": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3"
            },
            {
              "name": "https://github.com/CESNET/perun/pull/2635",
              "refsource": "MISC",
              "url": "https://github.com/CESNET/perun/pull/2635"
            },
            {
              "name": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039",
              "refsource": "MISC",
              "url": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-gj88-9q3f-72m3",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-5281",
    "datePublished": "2020-03-25T18:00:20",
    "dateReserved": "2020-01-02T00:00:00",
    "dateUpdated": "2024-08-04T08:22:09.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-5281 (GCVE-0-2020-5281)

Vulnerability from nvd – Published: 2020-03-25 18:00 – Updated: 2024-08-04 08:22
VLAI?
Summary
In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.
Severity ?
6.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N
CWE
  • CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Assigner
References
Impacted products
Vendor Product Version
CESNET perun Affected: < 3.9.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:22:09.083Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/perun/pull/2635"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "perun",
          "vendor": "CESNET",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-90",
              "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-25T18:00:20",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CESNET/perun/pull/2635"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039"
        }
      ],
      "source": {
        "advisory": "GHSA-gj88-9q3f-72m3",
        "discovery": "UNKNOWN"
      },
      "title": "LDAP connector injection in Perun",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-5281",
          "STATE": "PUBLIC",
          "TITLE": "LDAP connector injection in Perun"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "perun",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "CESNET"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3",
              "refsource": "CONFIRM",
              "url": "https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3"
            },
            {
              "name": "https://github.com/CESNET/perun/pull/2635",
              "refsource": "MISC",
              "url": "https://github.com/CESNET/perun/pull/2635"
            },
            {
              "name": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039",
              "refsource": "MISC",
              "url": "https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-gj88-9q3f-72m3",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-5281",
    "datePublished": "2020-03-25T18:00:20",
    "dateReserved": "2020-01-02T00:00:00",
    "dateUpdated": "2024-08-04T08:22:09.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}