CVE-2022-24832

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other users or entries within the LDAP database (e.g alternate fields, usernames, hashed passwords etc) through brute force mechanisms. This only affects users who have a working LDAP authorization configuration enabled on their GoCD server, and only is exploitable by users authenticating using such an LDAP configuration. This issue has been fixed in GoCD 22.1.0, which is bundled with gocd-ldap-authentication-plugin v2.2.0-144.

• CWE-74

• https://docs.gocd.org/22.1.0/configuration/dev_authentication.html#ldapad-authenticationVendor Advisory
• https://github.com/gocd/gocd-ldap-authentication-pluginProduct, Third Party Advisory
• https://github.com/gocd/gocd-ldap-authentication-plugin/commit/87fa7dac5d899b3960ab48e151881da4793cfcc3Patch, Third Party Advisory
• https://github.com/gocd/gocd-ldap-authentication-plugin/releases/tag/v2.2.0-144Release Notes, Third Party Advisory
• https://github.com/gocd/gocd/pull/10244Patch, Third Party Advisory
• https://github.com/gocd/gocd/releases/tag/22.1.0Release Notes, Third Party Advisory
• https://github.com/gocd/gocd/security/advisories/GHSA-x5v3-x9qj-mh3hThird Party Advisory
• https://www.gocd.org/releases/#22-1-0Release Notes, Vendor Advisory
• https://docs.gocd.org/22.1.0/configuration/dev_authentication.html#ldapad-authenticationVendor Advisory
• https://github.com/gocd/gocd-ldap-authentication-pluginProduct, Third Party Advisory
• https://github.com/gocd/gocd-ldap-authentication-plugin/commit/87fa7dac5d899b3960ab48e151881da4793cfcc3Patch, Third Party Advisory
• https://github.com/gocd/gocd-ldap-authentication-plugin/releases/tag/v2.2.0-144Release Notes, Third Party Advisory
• https://github.com/gocd/gocd/pull/10244Patch, Third Party Advisory
• https://github.com/gocd/gocd/releases/tag/22.1.0Release Notes, Third Party Advisory
• https://github.com/gocd/gocd/security/advisories/GHSA-x5v3-x9qj-mh3hThird Party Advisory
• https://www.gocd.org/releases/#22-1-0Release Notes, Vendor Advisory

Published

Apr 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24827Elide is a Java library that lets you stand up a GraphQL/JSO…8.1
• CVE-2022-24828Composer is a dependency manager for the PHP programming lan…8.8
• CVE-2022-24829Garden is an automation platform for Kubernetes development …9.8
• CVE-2022-2483 The bootloader in the Nokia ASIK AirScale system module (ve…7.1
• CVE-2022-24830OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24831OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24833PrivateBin is minimalist, open source online pastebin clone …6.1
• CVE-2022-24834Redis is an in-memory database that persists on disk. A spec…8.8
• CVE-2022-24836Nokogiri is an open source XML and HTML library for Ruby. No…7.5
• CVE-2022-24837HedgeDoc is an open-source, web-based, self-hosted, collabor…5.3
• CVE-2022-24838Nextcloud Calendar is a calendar application for the nextclo…9.8
• CVE-2022-24839org.cyberneko.html is an html parser written in Java. The fo…7.5