Vulnerability feed

Executive summary

Pleasanter, a web application from Implem Inc., has an LDAP authentication bypass flaw affecting versions 1.1.0.0 to 1.5.9.0 under certain configurations. An attacker can log in with only a valid Login ID and no password, then view, change, or delete data with that account's privileges. The vendor recommends updating to version 1.5.9.1, or applying a workaround if an update cannot be done soon.

Technical summary

The flaw is classified as Missing Critical Step in Authentication (CWE-304) and is an authentication bypass. The advisory states the product is affected only when LDAP authentication is enabled and it runs on Linux (including Docker images), or on Windows with DsProvider set to Novell, and it is integrated with Active Directory or another LDAP server such as OpenLDAP or 389 Directory Server with Anonymous Bind allowed. The attack vector is network-based and requires no privileges or user interaction, according to the CVSS vectors given (CVSS 4.0 base score 6.9; CVSS 3.0 base score 6.5). Affected versions are 1.1.0.0 to 1.5.9.0, and the fixed version is 1.5.9.1. The advisory gives a workaround but does not describe its details and instead says to contact the developer. Detection guidance and evidence of exploitation in the wild are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from jvn.jp/en/jp/JVN82312317

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

Implem Inc.Implem Inc. Pleasanter