What’s Vulnerable › Vulnerabilities

CVE-2020-5281: LDAP connector injection in Perun

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-25 · updated 2026-06-17
• Weakness: CWE-90

Description

In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.

Affected products

• CESNET perun: before 3.9.1 — fixed in 3.9.1

How to fix

Upgrade to a fixed version: CESNET perun 3.9.1. Check the vendor advisory for mitigations.

References

• https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039
• https://github.com/CESNET/perun/pull/2635
• https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3
• https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039
• https://github.com/CESNET/perun/pull/2635
• https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3

Get alerted when CVE-2020-5281 or the next vulnerability affects your stack