CVE-2015-6538

Critical

Published: 27/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The login page in Epiphany Cardio Server versions 3.3, 4.0, and 4.1 mishandles authentication requests, allowing remote attackers to conduct LDAP injection attacks and bypass intended access restrictions via a crafted URL.

Risk Assessment

Attackers may gain access to resources they should not have permission to access, potentially leading to data leaks or unauthorized access to the system.

Recommendation

It is recommended to upgrade to the latest version of Epiphany Cardio Server to eliminate this vulnerability and implement additional security measures against LDAP injection attacks.

Original NVD description (English source)

The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.