CVE-2015-7294

ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.

ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.

Versions 2.2.4 and earlier of `ldapauth-fork` are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter. ## Recommendation ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use [ldapauth-fork](https://www.npmjs.com/package/ldapauth-fork) 2.3.3 or greater.

Versions 2.2.4 and earlier of `ldapauth-fork` are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter. ## Recommendation ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use [ldapauth-fork](https://www.npmjs.com/package/ldapauth-fork) 2.3.3 or greater.

ldapauth-fork en versiones anteriores a la 2.3.3 permite que atacantes remotos realicen ataques de inyección LDAP utilizando un nombre de usuario manipulado.