CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (LDAP Injection), page 3
Filter
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
What the weakness is: CWE-90 at MITRE
Related attack patterns (CAPEC): 1
- CAPEC-136 LDAP Injection Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-90, as MITRE names them. Credits.
Ask an AI about CWE-90
Show the prompt
Explain CWE-90: Improper Neutralization of Special Elements used in an LDAP Query and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/90.html and https://cve.bz/cve/cwe/90?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.7CVE-2016-9870EPSS 0.4%
EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon OneFS 7.1.0.x is affected by an LDAP injection vulnerability that could potentially be exploited by…
- 9.8CVE-2016-9299ExploitEPSS 97%
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.