CVE-2017-14596

In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.

• CWE-90

• http://www.securityfocus.com/bid/100898Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039407Third Party Advisory, VDB Entry
• https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/Exploit, Technical Description, Third Party Advisory
• https://developer.joomla.org/security-centre/711-20170902-core-ldap-information-disclosureVendor Advisory
• http://www.securityfocus.com/bid/100898Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039407Third Party Advisory, VDB Entry
• https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/Exploit, Technical Description, Third Party Advisory
• https://developer.joomla.org/security-centre/711-20170902-core-ldap-information-disclosureVendor Advisory

Published

Sep 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14590Bamboo did not check that the name of a branch in a Mercuria…
• CVE-2017-14591Atlassian Fisheye and Crucible versions less than 4.4.3 and …
• CVE-2017-14592Sourcetree for macOS had several argument and command inject…
• CVE-2017-14593Sourcetree for Windows had several argument and command inje…
• CVE-2017-14594The printable searchrequest issue resource in Atlassian Jira…
• CVE-2017-14595In Joomla! before 3.8.0, a logic bug in a SQL query could le…
• CVE-2017-14597AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XS…
• CVE-2017-1460IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue…
• CVE-2017-14600Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injecti…
• CVE-2017-14601Pragyan CMS v3.0 is vulnerable to a Boolean-based SQL inject…
• CVE-2017-14602A vulnerability has been identified in the management interf…
• CVE-2017-14603In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14…