Repository navigation

[Python] CWE-287: LDAP Improper Authentication #320

Closed

Labels

opened

on Mar 18, 2021

Query

Relevant PR: github/codeql#5444

Report

This query identifies cases in which a LDAP connection doesn't carry any kind of authentication. Anonymous binds and unauthenticated binds allow access to information in the LDAP directory without providing a password, their use is therefore strongly discouraged.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

Result(s)

INGInious

jorgectf
added
All For OneSubmissions to the All for One, One for All bounty
on Mar 18, 2021
ghsecuritylab commented on May 25, 2021
ghsecuritylab
on May 25, 2021
Collaborator
Your submission is now in status SecLab review.

For information, the evaluation workflow is the following:
SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commented on Jun 22, 2021
ghsecuritylab
on Jun 22, 2021
Collaborator
Your submission is now in status Generate Query Results.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commented on Jun 28, 2021
ghsecuritylab
on Jun 28, 2021
Collaborator
Your submission is now in status FP Check.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commented on Jul 15, 2021
ghsecuritylab
on Jul 15, 2021
Collaborator
Your submission is now in status CodeQL review.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commented on Jul 22, 2021
ghsecuritylab
on Jul 22, 2021
Collaborator
Your submission is now in status SecLab finalize.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
ghsecuritylab commented on Aug 2, 2021
ghsecuritylab
on Aug 2, 2021
Collaborator
Your submission is now in status Pay.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed
xcorail commented on Aug 2, 2021
xcorail
on Aug 2, 2021
Contributor
Created Hackerone report 1287575 for bounty 323071 : [320] [Python] CWE-287: LDAP Improper Authentication
xcorail
closed this as completed on Aug 2, 2021
ghsecuritylab commented on Aug 2, 2021
ghsecuritylab
on Aug 2, 2021
Collaborator
Your submission is now in status Closed.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed

to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests