CVE-2026-11748

6.9 Moyenne

Publiée le 22/06/2026 à 05:16 · Modifiée le 22/06/2026 à 22:21 · Analyse NVD reportée · Source : dl_cve@linecorp.com

Description

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure.

Traduire en français

Produits concernés

LY Corporation Central Dogma

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	dl_cve@linecorp.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-90

Références

https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75
https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories