CVE-2018-8763 — Cross-site Scripting in Ldap Account Manager

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 36.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Ldap-account-manager Ldap Account ManagerDebian Ldap-account-managerDebian Linux
Timeline
PublishedMar 27
Latest updateMay 14

Description

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php URI or the template parameter to the templates/3rdParty/pla/htdocs/cmd.php?cmd=rename_form URI.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶debiandebian/ldap-account-manager< ldap-account-manager 6.3-1 (bookworm)

Also affects: Debian Linux 7.0, 8.0, 9.0

🔴Vulnerability Details

2
GHSA
GHSA-pcvp-8j6c-wg38: Roland Gruber Softwareentwicklung LDAP Account Manager before 6↗2022-05-14
▶
OSV
CVE-2018-8763: Roland Gruber Softwareentwicklung LDAP Account Manager before 6↗2018-03-27
▶

📋Vendor Advisories

1
Debian
CVE-2018-8763: ldap-account-manager - Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via th...↗2018
▶

💬Community

1
Bugzilla
CVE-2018-20217 krb5: Reachable assertion in the KDC using S4U2Self requests↗2019-01-10
▶