A false LDAP search filter can be constructed when a user-controlled Apache environment variable is used to supply the username. The resulting injection could bypass authentication checks or retrieve sensitive LDAP information. The weakness is a classic LDAP injection, identified as CWE‑90, resulting in potential loss of confidentiality or integrity for data stored in the directory.

The vulnerability affects the MISP threat intelligence platform. Versions prior to 2.5.36 of MISP are impacted. The issue arises in the ApacheAuthenticate component when ApacheAuthenticate.apacheEnv is configured to use a user‑controlled environment variable instead of the default REMOTE_USER used in typical proxy setups.

The CVSS score of 8.8 classifies this flaw as high. Although an EPSS score is not available, the attack vector is clearly external: an attacker who can control the specified Apache variable may influence the LDAP query. Because the vulnerability is not listed in the CISA KEV catalog, no public exploit is known, but the high severity and external nature warrant immediate attention.