This product is not supported for your selected Datadog site. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: php-security/ldap-without-password

Language: PHP

Severity: Warning

Category: Security

CWE: 287

Description

This rule flags instances where a connection to an LDAP server is attempted without providing a password. Binding without a password can lead to anonymous access, which may expose sensitive directory information or allow unauthorized modifications.

To comply with this rule, always supply a valid password when calling ldap_bind. For example, use ldap_bind($server, $dn, $password); where $password is a non-empty string containing the correct credentials. If anonymous binding is necessary, ensure that it is a conscious decision backed by appropriate safeguards and documented accordingly.

Non-Compliant Code Examples

<?
ldap_bind($server, $dn, '');
ldap_bind($server, $dn, NULL);
?>

Compliant Code Examples

<?
ldap_bind($server, $dn, $password);
?>
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains