GHSA-26cm-qrc6-mfgj

    Dashboard / Vulnerabilities / GHSA-26cm-qrc6-mfgj

    GHSA-26cm-qrc6-mfgj

    Published: 8 Nov 2021Last Modified: 8 Jul 2026

    Summary: Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

    Details: ### Impact LDAP injection vulnerability, only affects instances with LDAP authentication enabled. ### Patches Patch for vulnerability released with v1.16.3. ### Workarounds Disable LDAP feature if in use ### References [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html ) ### For more information If you have any questions or comments about this advisory: * Open an issue in [Thunderdome Github Repository](https://github.com/StevenWeathers/thunderdome-planning-poker) * Email us at [[email protected]](mailto:[email protected])

    References: https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgj, https://nvd.nist.gov/vuln/detail/CVE-2021-41232, https://github.com/github/securitylab/issues/464#issuecomment-957094994, https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1, https://github.com/StevenWeathers/thunderdome-planning-poker

    Affected packages

    Package

    Name: github.com/stevenweathers/thunderdome-planning-poker

    Purl: pkg:golang/github.com/stevenweathers/thunderdome-planning-poker

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.16.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-26cm-qrc6-mfgj | CVE-DB