PT-2023-11353 · Unknown · Ldapcherry

Published 2023-01-05 · Updated 2024-05-17 · CVE-2019-25095

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions kakwa LdapCherry versions up to 0.x

Description A problematic issue was found in the URL Handler component, leading to cross site scripting. The attack can be launched remotely, affecting an unknown function.

Recommendations For versions up to 0.x, upgrade to version 1.0.0 to address this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25095

GHSA-VQ8W-X8V7-F88M

PYSEC-2023-19

Affected Products

Ldapcherry

References · 11

• https://github.com/kakwa/ldapcherry/pull/16 · Patch
• https://github.com/kakwa/ldapcherry/releases/tag/1.0.0 · Patch
• https://github.com/kakwa/ldapcherry/commit/6f98076281e9452fdb1adcd1bcbb70a6f968ade9 · Patch
• https://osv.dev/vulnerability/CVE-2019-25095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25095 · Security Note
• https://osv.dev/vulnerability/GHSA-vq8w-x8v7-f88m · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-19 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/ldapcherry/PYSEC-2023-19.yaml · Note
• https://github.com/kakwa/ldapcherry · Note
• https://vuldb.com/?ctiid.217434 · Note
• https://vuldb.com/?id.217434 · Note