Medium severity5.4NVD Advisory· Published Sep 17, 2025· Updated Jun 17, 2026

CVE-2025-35431

Description

CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cisagov/Thorium3 versions
cpe:2.3:a:cisa:thorium:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:cisa:thorium:*:*:*:*:*:*:*:*range: >=1.0.0,<1.1.1
- (no CPE)range: <1.1.1
- (no CPE)range: 1.0.0

Patches

Vulnerability mechanics

References

github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820cnvdPatch
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.jsonnvdThird Party Advisory
www.cve.org/CVERecordnvdThird Party Advisory
github.com/cisagov/thorium/releases/tag/1.1.1nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000