CVE-2016-6497 main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search...
HighCVSS 7.5
EPSS 5.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache groovy ldap | All versions | No fix listed |
References
- svn.apache.org mailing-list third-party-advisory
- 95929 third-party-advisory vdb-entry
- [directory-users] 20161029 Security vulnerability in Groovy LDAP API mailing-list third-party-advisory
- www.blackhat.com technical-description third-party-advisory
- www.oracle.com patch