Insecure LDAP Certificate Validation in Apache Session Browseable by LemonLDAP
CVE-2020-36659

8.1HIGH

Key Information:

Vendor

Lemonldap-ng

Status
Apache\
Vendor
CVE Published:
27 January 2023

What is CVE-2020-36659?

Before version 1.3.6, Apache::Session::Browseable is susceptible to an issue where the X.509 certificate validity is not verified by default during connections to remote LDAP backends. This vulnerability arises from the default behavior of the Net::LDAPS module in Perl, which can expose users to potential man-in-the-middle attacks if not properly configured. To mitigate the risk, updates should be applied alongside fixes for related vulnerabilities.

References

https://github.com/LemonLDAPNG/Apache-Session-Browseable/...
https://lists.debian.org/debian-lts-announce/2023/01/msg0...
mailing-list

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.