What’s Vulnerable › Vulnerabilities

CVE-2021-32651: LDAP injection via OneDev may leak some LDAP directory information

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-01 · updated 2026-06-17
• Weakness: CWE-90

Description

OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2.

Affected products

• theonedev onedev: before 4.4.2 — fixed in 4.4.2

How to fix

Upgrade to a fixed version: theonedev onedev 4.4.2. Check the vendor advisory for mitigations.

References

• https://github.com/theonedev/onedev/commit/4440f0c57e440488d7e653417b2547eaae8ad19c
• https://github.com/theonedev/onedev/security/advisories/GHSA-5864-2496-4xjf
• https://github.com/theonedev/onedev/commit/4440f0c57e440488d7e653417b2547eaae8ad19c
• https://github.com/theonedev/onedev/security/advisories/GHSA-5864-2496-4xjf

Get alerted when CVE-2021-32651 or the next vulnerability affects your stack