PT-2024-5224 · Unknown+1 · Phpldapadmin+1

Mhuertos · Published 2024-07-10 · Updated 2024-07-19 · CVE-2016-15039

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38

Description: A critical vulnerability was found in the function makeHttpRequest of the file htdocs/js/ajax functions.js, which can lead to HTTP request smuggling. The attack can be launched remotely. This issue is related to inconsistent interpretation of HTTP requests.

Recommendations: Apply the patch named dd6e9583a2eb2ca085583765e8a63df5904cb036 to fix this issue. As a temporary workaround, consider disabling the makeHttpRequest function until the patch is applied.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2024-05788

CVE-2016-15039

Affected Products

Red Os

Phpldapadmin

References · 16

• https://github.com/mhuertos/phpLDAPadmin/commit/dd6e9583a2eb2ca085583765e8a63df5904cb036 · Patch
• https://osv.dev/vulnerability/CVE-2016-15039 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-15039 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-15039 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-15039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15039 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-15039 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-15039 · Security Note
• https://bdu.fstec.ru/vul/2024-05788 · Security Note
• https://github.com/leenooks/phpLDAPadmin/commit/dd6e9583a2eb2ca085583765e8a63df5904cb036 · Note
• https://vuldb.com/?id.270523 · Note
• https://t.me/cvenotify/85758 · Telegram Post
• https://vuldb.com/?ctiid.270523 · Note
• https://t.me/cvedetector/628 · Telegram Post
• https://redos.red-soft.ru/support/secure · Note