title: Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
description: Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection attack to leak arbitrary attributes from LDAP database. This issue is fixed in versions 3.5.8, 4.0.4, and 4.1.2.
problem types: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
affected:
{
vendor: mastodon
product: mastodon
versions:
version: >= 2.5.0, < 3.5.8, status: affected
version: >= 4.0.0, < 4.0.4, status: affected
version: >= 4.1.0, < 4.1.2, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]