CVE-2022-29155

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

https://bugs.openldap.org/show_bug.cgi?id=9815Exploit, Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00032.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220609-0007/Third Party Advisory
https://www.debian.org/security/2022/dsa-5140Third Party Advisory
https://bugs.openldap.org/show_bug.cgi?id=9815Exploit, Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00032.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220609-0007/Third Party Advisory
https://www.debian.org/security/2022/dsa-5140Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline

Published: May 4, 2022
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-291567.8drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.CVE-2022-291587.5Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by ext CVE-2022-291594.3Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenti CVE-2022-291603.3Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, image CVE-2022-291619.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate CVE-2022-291627.8runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version CVE-2022-291634.3Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user CVE-2022-291647.1Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an att CVE-2022-2916510.0Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting w CVE-2022-291668.8matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into CVE-2022-291677.5Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of CVE-2022-291686.1Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when renderi