CVE-2021-41232
High
Description
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
SeverityHigh
CVSS8.1
Exploit probability—
ProductThunderdome Planning Poker
PublishedNov 2, 2021
First seenNov 2, 2021
Weakness typeCWE-90CWE-90CWE-74Injection
How to fix
Update
- thunderdome planning_poker1.16.3 or later
- github.com/stevenweathers/thunderdome-planning-poker1.16.3 or later
- github.com/StevenWeathers/thunderdome-planning-poker1.16.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thunderdome planning_poker | v < 1.16.3 | 1.16.3 |
| github.com/stevenweathers/thunderdome-planning-pokerGo | v < 1.16.3 | 1.16.3 |
| github.com/StevenWeathers/thunderdome-planning-pokerGo | v < 1.16.3 | 1.16.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.