Server-Side Request Forgery in LemonLDAP::NG by OW2
CVE-2023-44469

4.3MEDIUM

Key Information:

Vendor

Lemonldap-ng

Status
Lemonldap\
Vendor
CVE Published:
29 September 2023

What is CVE-2023-44469?

A Server-Side Request Forgery issue exists in the OpenID Connect Issuer of LemonLDAP::NG prior to version 2.17.1. This vulnerability allows authenticated remote attackers to exploit the request_uri authorization parameter, enabling them to send GET requests to arbitrary URLs. This can potentially lead to unauthorized access and exploitation of sensitive internal resources by manipulating requests from the server.

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues...
https://security.lauritz-holtmann.de/post/sso-security-ssrf/
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releas...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.