5.3

CVE-2026-81205

LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Miniorange ≫ Ldap / Active Directory Integration SwPlatform drupal Version >= 2.0.1 < 2.2.1
Miniorange ≫ Ldap / Active Directory Integration SwPlatform drupal Version >= 7.x-1.0 <= 7.x-1.21
Miniorange ≫ Ldap / Active Directory Integration SwPlatform drupal Version >= 8.x-1.0 <= 8.x-1.34
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.256
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

https://www.drupal.org/sa-contrib-2026-115
Third Party Advisory