CVE-2025-35431

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-35431

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-35431.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-35431

Published

2025-09-17T16:52:16Z

Modified

2026-08-12T03:51:29Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

CISA Thorium LDAP injection

Details

CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1.

Database specific

{
    "cna_assigner": "cisa-cg",
    "cwe_ids": [
        "CWE-90"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/35xxx/CVE-2025-35431.json"
}

References

Affected packages

Git / github.com/cisagov/thorium

Affected ranges

Type

GIT

Repo

https://github.com/cisagov/thorium

Events

Introduced

Fixed

7c94a0b9bc2dc55e0c307360452f348bac06820c

Database specific

Show details

{
    "cpe": "cpe:2.3:a:cisa:thorium:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-35431.json"