Pleasanter LDAP Authentication Bypass Vulnerability
Pleasanter LDAP Authentication Bypass Vulnerability 🚨
LDAP authentication of Pleasanter contains an authentication bypass vulnerability. Pleasanter, provided by Implem Inc., fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. This issue is identified as a Missing Critical Step in Authentication (CWE-304). The vulnerability has been assigned CVE-2026-113438.
Severity Ratings
- CVSS 4.0 Base Score: 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N)
- CVSS 3.0 Base Score: 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Affected Versions
The authentication bypass vulnerability affects Pleasanter versions 1.1.0.0 to 1.5.9.0. Specific conditions for exploitation include having LDAP authentication enabled, and the software being installed on a Linux environment (including docker images), or a Windows environment with “DsProvider” set to “Novell”. Furthermore, the affected systems must be integrated with an Active Directory or some other LDAP server, such as OpenLDAP or 389 Directory Server, with Anonymous Bind allowed.
Impact
The impact of this vulnerability is significant, as an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a direct result, an attacker may view, alter, or delete information stored in the product with the privilege of the account used to log in.
Mitigation
To mitigate this vulnerability, users should update the software to the latest version according to the information provided by the developer. The developer has released version 1.5.9.1 that directly addresses the vulnerability. If the software cannot be updated soon for some reason, the developer recommends applying a workaround; users should contact the developer for the details of this workaround.
This vulnerability was reported by Implem Inc. to IPA to notify users of its solution through JVN. JPCERT/CC and Implem Inc. coordinated under the Information Security Early Warning Partnership regarding this issue.