CVE-2026-11748

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11748", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "state": "PUBLISHED", "assignerShortName": "LY-Corporation", "dateReserved": "2026-06-09T06:50:03.618Z", "datePublished": "2026-06-22T02:37:35.370Z", "dateUpdated": "2026-06-22T16:12:07.208Z"}, "containers": {"cna": {"affected": [{"vendor": "LY Corporation", "product": "Central Dogma", "defaultStatus": "affected", "versions": [{"version": "0.84.0", "status": "unaffected", "versionType": "custom", "lessThan": "*"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-90"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure."}], "references": [{"url": "https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2026-06-22T02:37:35.370Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-90", "lang": "en", "description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')"}]}], "references": [{"url": "https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T16:11:47.695670Z", "id": "CVE-2026-11748", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T16:12:07.208Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11748", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T16:11:47.695670Z"}}}], "references": [{"url": "https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-90", "description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T16:11:30.982Z"}}], "cna": {"metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N"}}], "affected": [{"vendor": "LY Corporation", "product": "Central Dogma", "versions": [{"status": "unaffected", "version": "0.84.0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-90"}]}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2026-06-22T02:37:35.370Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11748", "state": "PUBLISHED", "dateUpdated": "2026-06-22T16:12:07.208Z", "dateReserved": "2026-06-09T06:50:03.618Z", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "datePublished": "2026-06-22T02:37:35.370Z", "assignerShortName": "LY-Corporation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Central Dogma", "vendor": "LY Corporation", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0.84.0", "versionType": "custom"}]}], "source": "dl_cve@linecorp.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en las versiones de centraldogma-server-auth-shiro anteriores a la 0.84.0, donde el SearchFirstActiveDirectoryRealm sustituye el nombre de usuario de inicio de sesi\u00f3n en un filtro de b\u00fasqueda LDAP sin neutralizar los metacaracteres del filtro LDAP, permitiendo a un atacante no autenticado manipular el filtro para causar confusi\u00f3n en la autenticaci\u00f3n y enumerar la estructura del directorio."}], "id": "CVE-2026-11748", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "dl_cve@linecorp.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11748", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T16:11:47.695670Z", "version": "2.0.3"}}]}, "published": "2026-06-22T03:16:42.950", "references": [{"source": "dl_cve@linecorp.com", "url": "https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75"}], "sourceIdentifier": "dl_cve@linecorp.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-90"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0.84.0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Central Dogma", "source": "cna", "vendor": "LY Corporation"}, "product": "central_dogma", "vendor": "ly_corporation"}], "created": "2026-06-22T04:30:16.877617+00:00", "title": "LDAP Injection in SearchFirstActiveDirectoryRealm Allows Directory Enumeration", "updated": "2026-06-23T21:03:44.699420+00:00", "vendors": ["ly_corporation", "ly_corporation$PRODUCT$central_dogma"], "weaknesses": ["CWE-90"]}