CVE-2026-49469
2026-09-25
19h16 +00:00
19h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improper Neutralization of Special Elements used in an LDAP Query The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component. |
