CVE-2020-5281: cesnet perun LDAP Injection
CVSS: 7.5v3.1HighModified
Published 25-03-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-5281 is a high (CVSS 7.5) LDAP Injection vulnerability in cesnet perun. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.3% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.36%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 25-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources2 sources · 6.2–7.5
- CVE.orgCNA6.2MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:NDiffers
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
1.36%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.36% on 20-09-2026
20-09-202620-10-2026
EPSS score1.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Cesnet1 product
- perun< 3.9.1
1 vendor · 1 product
References
3 links- github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3X Refsource CONFIRMThird Party Advisory
- github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039X Refsource MISCPatchThird Party Advisory