Security readout for executives and security teams
Plain-English summary
OneDev versions 4.4.1 and earlier can expose limited LDAP directory information when LDAP external authentication is enabled. An authenticated attacker may manipulate LDAP search behavior, but exploitation is rated high-complexity and requires valid access. The vendor fixed the issue in OneDev 4.4.2.
Executive priority
Low but actionable. Remediate during the next normal maintenance window, faster if OneDev is exposed to broad internal users or integrates with sensitive LDAP directories. The fix is available and the affected condition is specific.
Technical view
CVE-2021-32651 is a CWE-90 LDAP injection in OneDev’s LDAP external authentication user search filter handling. A low-privileged attacker could forge queries through the application and infer parts of the LDAP tree using blind LDAP injection. Impact is limited to confidentiality, with no cited integrity or availability impact.
Likely exposure
Exposure is limited to organizations running OneDev 4.4.1 or earlier with LDAP external authentication enabled. Instances not using LDAP external authentication are not described as affected by the source bundle. Public internet exposure is not required by the CVSS vector, but network reachability to OneDev matters.
Exploitation context
The sources do not report active exploitation, and this CVE is not marked as KEV. Exploitation requires authenticated access and depends on the local User Search Filter configuration, raising practical difficulty. Treat it as a targeted information-disclosure risk rather than a broad unauthenticated compromise path.
Researcher notes
Focus validation on version, LDAP external authentication state, and User Search Filter configuration. The advisory says payload details depend on local configuration, so avoid generic exploit assumptions. Evidence supports limited LDAP directory disclosure only; no source claims privilege escalation, code execution, or active exploitation.
Mitigation direction
- Upgrade OneDev to version 4.4.2 or later.
- Identify and prioritize OneDev instances with LDAP external authentication enabled.
- If upgrade is delayed, assess temporarily disabling LDAP external authentication per operational requirements.
- Review OneDev’s advisory and patched commit for vendor-specific remediation details.
- Monitor logs for unusual authentication search behavior, without relying on logs as proof of absence.
Validation and detection
- Inventory OneDev versions and confirm none are 4.4.1 or earlier.
- Check whether LDAP external authentication is enabled on each OneDev instance.
- Review the User Search Filter configuration for risky custom LDAP query construction.
- Confirm patched instances authenticate LDAP users successfully after upgrade.
- Document any remaining legacy instance and its compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-90: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N1.61.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.1LowVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/theonedev/onedev/security/advisories/GHSA-5864-2496-4xjfCVE reference · x_refsource_CONFIRM
- https://github.com/theonedev/onedev/commit/4440f0c57e440488d7e653417b2547eaae8ad19cCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.