What’s Vulnerable › Vulnerabilities

CVE-2021-41232: Improper Neutralization of Special Elements used in an LDAP Query

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-02 · updated 2026-06-17
• Weakness: CWE-74

Description

Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.

Affected products

• StevenWeathers thunderdome-planning-poker: before 1.16.3 — fixed in 1.16.3

How to fix

Upgrade to a fixed version: StevenWeathers thunderdome-planning-poker 1.16.3. Check the vendor advisory for mitigations.

References

• https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1
• https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgj
• https://github.com/github/securitylab/issues/464#issuecomment-957094994
• https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1
• https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgj
• https://github.com/github/securitylab/issues/464#issuecomment-957094994

Get alerted when CVE-2021-41232 or the next vulnerability affects your stack