CVE-2024-54852

critical · 9.8

When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.

9.8

CVSS

0.8%

EPSS (exploit prob.)

54th

EPSS percentile

2025-01-29

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-90

Affected products

Vendor	Product	Affected versions
sismics	teedy	>= 1.9, <= 1.12

Check a specific version with /api/v1/cve/match.

References

https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md
https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-54852