CWE-90 LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入) 类漏洞列表 88

CWE-90 LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入) 类弱点 88 条 CVE 漏洞汇总，含 AI 中文分析。

常见影响 (1)

Confidentiality, Integrity, Availability Execute Unauthorized Code or Commands, Read Application Data, Modify Application Data

An attacker could include input that changes the LDAP query which allows unintended commands or code to be executed, allows sensitive data to be read or modified or causes other unintended behavior.

缓解措施 (1)

Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…

代码示例 (1)

The code below constructs an LDAP query using user input address data:

context = new InitialDirContext(env); String searchFilter = "StreetAddress=" + address; NamingEnumeration answer = context.search(searchBase, searchFilter, searchCtls);

Bad · Java