« Volver al listado

CVE-2026-42568

Estado: AplazadaMedia (4.3)—

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Spaceapplications — YamcsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42568",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42568",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-11T14:47:09.450504Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "yamcs",
          "product": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.12.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-10T23:16:46.550",
  "references": [
    {
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-90"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue."
    },
    {
      "lang": "es",
      "value": "Yamcs es un framework de control de misión. Antes de las versiones 5.13.0 y 5.12.7, existe una vulnerabilidad de inyección LDAP en 'org.yamcs.security.LdapAuthModule' al construir filtros de búsqueda. El parámetro de nombre de usuario se inserta directamente en el filtro LDAP sin el escape RFC 4515 adecuado. Las versiones 5.13.0 y 5.12.7 parchean el problema."
    }
  ],
  "lastModified": "2026-07-21T19:10:00.107",
  "sourceIdentifier": "security-advisories@github.com"
}