Active Directory

Security Warnings

• Man-in-the-middle vulnerability due to missing certificate check(last version affected: 2.2)
• Improper certificate validation(last version affected: 2.10)
• Missing permission check allows accessing domain health check page(last version affected: 2.19)
• Login allowed with empty password(last version affected: 2.19)
• Login allowed with hardcoded password(last version affected: 2.19)
• Authentication cache allows logging in with any password(last version affected: 2.19)
• CSRF vulnerability(last version affected: 2.19)
• User passwords transmitted in plain text(last version affected: 2.25)
• Password transmitted in plain text(last version affected: 2.30)
• RCE vulnerability from unvalidated LDAP referrals(last version affected: 2.41)
• LDAP injection vulnerability(last version affected: 2.41.1)