PT-2018-11160 · Ldap Tool Box · Ltb Self Service Password

Coudot · Published 2018-06-14 · Updated 2018-08-10 · CVE-2018-12421

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LTB (aka LDAP Tool Box) Self Service Password versions prior to 1.3

Description The issue allows a change to a user password without knowing the old password via a crafted POST request. This is due to the mishandling of the ldap bind return value and the lack of constraint on the PHP data type to be a string.

Recommendations For versions prior to 1.3, update to version 1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the password change functionality until the update is applied.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2018-12421

Affected Products

Ltb Self Service Password

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-12421 · Security Note
• https://lists.ltb-project.org/pipermail/ltb-announce/2018-June/000023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12421 · Vendor Advisory
• https://github.com/ltb-project/self-service-password/issues/209 · Note
• https://github.com/ltb-project/self-service-password/issues/211 · Note