CVE-2024-54852 - When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection

Back Back to CVE browser

CRITICAL

When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection

Published Jan 29, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 0.77%

Description

When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-90

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52685
Advisory
https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md
exploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52685		Advisory
https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md		exploitThird Party Advisory