CVE-2025-52575

Katalog CVE

CVSS 6.5 · Medium EPSS 0,75%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') pada espocrm. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration. This was fixed in version 9.1.7.

Rincian

Terbit di NVD

21 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/espocrm/espocrm/security/advisories/GHSA-rjm8-77fr-4f3v exploit · advisory vendor
• https://github.com/espocrm/espocrm/commit/8649f1ac0ce714b2c31727bca3dd95d06e17337f patch