CVE-2024-33868

LDAP injection (CWE-90) occurs when user-supplied input is not properly filtered or escaped before being included in LDAP queries. An attacker can craft malicious input that modifies the logic of the LDAP query sent by the application to the directory server. As a result, it is possible to bypass authentication mechanisms, gain access to unauthorized resources, or read sensitive data from the LDAP directory. The attack vector is network-based, requires no authentication or user interaction.

An attacker can gain unauthorized access to sensitive data stored in the LDAP directory, bypass authentication mechanisms, and potentially modify data or compromise system integrity and availability (CVSS C:H/I:H/A:H).

The Linqi application should be updated to version 1.4.0.1 or newer. Detailed information about the security update is available in the manufacturer's documentation at https://linqi.help/Updates/en#/SecurityUpdates.

Linqi application in versions before 1.4.0.1 running on Microsoft Windows system.