{"id":"CVE-2022-45910","state":"PUBLISHED","title":"Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities","description":"Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries (DoS, additional queries, filter manipulation) during user lookup, if the username or the domain string are passed to the UserACLs servlet without validation.\n\nThis issue affects Apache ManifoldCF version 2.23 and prior versions.","publishedAt":"2022-12-07T09:50:52.700Z","updatedAt":"2025-04-22T21:02:38.711Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache ManifoldCF"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache ManifoldCF","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.23","versionType":"maven"}]}],"references":["https://lists.apache.org/thread/m693p0dq6jvwwvmy2wnhj6k854z0s444"],"weaknesses":["CWE-90","CWE-74"],"ingestedAt":"2026-10-29T19:50:51.061Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/45xxx/CVE-2022-45910.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-45910","state":"PUBLISHED","datePublished":"2022-12-07T09:50:52.700Z","dateUpdated":"2025-04-22T21:02:38.711Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","requesterUserId":"cf81350d-439c-4450-9d42-0a054bb6b6c9","dateReserved":"2022-11-26T16:22:46.368Z"},"containers":{"cna":{"title":"Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities","descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries (DoS, additional queries, filter manipulation) during user lookup, if the username or the domain string are passed to the UserACLs servlet without validation.\n\nThis issue affects Apache ManifoldCF version 2.23 and prior versions."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache ManifoldCF","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.23","versionType":"maven"}]}],"references":[{"url":"https://lists.apache.org/thread/m693p0dq6jvwwvmy2wnhj6k854z0s444","tags":["mailing-list","vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-90","description":"CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2022-12-07T09:53:12.935Z"},"credits":[{"lang":"en","type":"finder","value":"4ra1n of Chaitin Tech"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/m693p0dq6jvwwvmy2wnhj6k854z0s444","tags":["mailing-list","vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T14:24:03.220Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-22T21:02:34.665695Z","id":"CVE-2022-45910","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-22T21:02:38.711Z"}}]}}}