WS-2020-0437

In cloudron-surfer in versions 5.5.0 to 5.10.2 is vulnerable to enial of service via LDAP Injection...

LDAP Injection

cloudron-surfer is vulnerable to LDAP injection. Lack of validation in the username parameter allows an attacker to inject and execute arbitrary LDAP statements, resulting in authentication bypass, information disclosure or potentially denial of service...

Node.js third-party modules: [cloudron-surfer] Denial of Service via LDAP Injection

I would like to report Denial of service via LDAP Injection vulnerability in cloudron-surfer module. It allows a malicious attacker to send a malformed input that is interpreted as an LDAP filter, leading to Denial of Service. Module module name: cloudron-surfer version: 5.9.0 npm page:...