Improper Access Control Affecting flask-ldapconn package, versions [,0.10.1)

Threat Intelligence

Not Defined

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Access Control vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-PYTHON-FLASKLDAPCONN-7413678
published1 Jul 2024
disclosed1 Jul 2024
creditUnknown

Report a new vulnerability Found a mistake?

Introduced: 1 Jul 2024

CWE-284 (opens in a new tab)

How to fix?

Upgrade Flask-LDAPConn to version 0.10.1 or higher.

Overview

Flask-LDAPConn is a Pure python, LDAP connection and ORM for Flask Applications

Affected versions of this package are vulnerable to Improper Access Control allowing authentication without a password if LDAP_SECRET was not configured, due to anonymous binds succeeding by default.

References

GitHub Commit

CVSS Scores

version 4.0

version 3.1

Attack Vector (AV)
Network
Attack Complexity (AC)
Low
Attack Requirements (AT)
None
Privileges Required (PR)
None
User Interaction (UI)
None

Confidentiality (VC)
High
Integrity (VI)
Low
Availability (VA)
None

Confidentiality (SC)
None
Integrity (SI)
None
Availability (SA)
None