BIT-mastodon-2023-28853

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/mastodon/BIT-mastodon-2023-28853.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-mastodon-2023-28853
Aliases
Published
2024-03-06T10:56:55.572Z
Modified
2025-10-15T02:27:12.769902Z
Summary
Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
Details

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection attack to leak arbitrary attributes from LDAP database. This issue is fixed in versions 3.5.8, 4.0.4, and 4.1.2.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / mastodon

Package

Name
mastodon
Purl
pkg:bitnami/mastodon

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
2.5.0
Fixed
3.5.8
Introduced
4.0.0
Fixed
4.0.4
Introduced
4.1.0
Fixed
4.1.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/mastodon/BIT-mastodon-2023-28853.json"