CVE-2026-113438
MEDIUM
6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.
304
Missing Critical Step in Authentication
DraftCommon Consequences
Security Scopes Affected:
Access Control
Integrity
Confidentiality
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Read Application Data
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
https://jvn.jp/en/jp/JVN82312317/
https://pleasanter.org/news/vulnerability-update-20261023/