PT-2023-29248 · Unknown · Lemonldap::Ng

Mike Lorang · Publicado 2023-09-28 · Atualizado 2023-10-08 · CVE-2023-44469

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LemonLDAP::NG versions prior to 2.17.1

Description A Server-Side Request Forgery issue in the OpenID Connect Issuer allows authenticated remote attackers to send GET requests to arbitrary URLs through the request uri authorization parameter.

Recommendations For versions prior to 2.17.1, update to version 2.17.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the request uri authorization parameter to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-44469

DLA-3612-1

Produtos afetados

Lemonldap::Ng

Referências · 20

• https://packages.debian.org/src:lemonldap-ng · Nota
• https://security-tracker.debian.org/tracker/DLA-3612-1 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1707641366858158511 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-44469 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-44469 · Nota de Segurança
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998 · Aviso do Fabricante
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.17.1 · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-44469 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1707704883112022520 · Publicação no Twitter
• https://t.me/cibsecurity/71269 · Publicação no Telegram
• https://t.me/cvenotify/59137 · Publicação no Telegram
• https://lists.debian.org/debian-lts-announce/2023/10/msg00014.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-44469 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-44469 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/lemonldap-ng · Aviso do Fabricante