Pleasanter does not correctly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. An attacker can bypass authentication by submitting only a valid login ID without a password. This leads to unauthorized access with the privileges of the chosen account, allowing the attacker to view, modify, or delete data in the application. The weakness corresponds to CWE-304, improper verification of credentials.

The affected product is Pleasanter from Implem Inc. No specific affected versions are listed in the available vendor data, so all deployments should be treated as potentially vulnerable until patch information is applied.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via LDAP authentication requests that the application receives, which means an attacker could exploit the flaw remotely by sending a crafted request to the web application. Once bypassed, the attacker gains the privileges of the supplied account, which can lead to significant data compromise.