Access Control Weakness in LemonLDAP::NG by OW2
CVE-2019-19791

9.8CRITICAL

Key Information:

Vendor

Lemonldap-ng

Status
Lemonldap\
Vendor
CVE Published:
29 May 2023

What is CVE-2019-19791?

LemonLDAP::NG versions prior to 2.0.7 have a significant access control misconfiguration due to the default Apache HTTP Server settings. These settings do not adequately restrict access to SOAP and REST endpoints when specific configurations of LemonLDAP::NG are applied. This allows attackers to craft malicious requests, potentially inserting 'index.fcgi' into URLs to bypass access controls, leading to unauthorized access to sensitive operations.

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1943
https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.