PT-2023-29248 · Unknown · Lemonldap::Ng

Mike Lorang · Published 2023-09-28 · Updated 2023-10-08 · CVE-2023-44469

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LemonLDAP::NG versions prior to 2.17.1

Description A Server-Side Request Forgery issue in the OpenID Connect Issuer allows authenticated remote attackers to send GET requests to arbitrary URLs through the request uri authorization parameter.

Recommendations For versions prior to 2.17.1, update to version 2.17.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the request uri authorization parameter to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-44469

DLA-3612-1

Affected Products

Lemonldap::Ng

References · 20

• https://security-tracker.debian.org/tracker/DLA-3612-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-44469 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-44469 · Security Note
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-44469 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-44469 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-44469 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/lemonldap-ng · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44469 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-44469 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44469 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3612-1 · Vendor Advisory
• https://packages.debian.org/src:lemonldap-ng · Note
• https://twitter.com/CVEnew/status/1707641366858158511 · Twitter Post
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.17.1 · Note