CVE-2026-24130

Katalog CVE

CVSS 5.3 · Medium EPSS 0,31%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') pada arksine moonraker. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.

Rincian

Terbit di NVD

22 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g mitigasi · advisory vendor
• https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42 patch