CVE-2021-40874 — Improper Authentication in Lemonldap-ng

CWE-287 — Improper Authentication4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.3%
top 46.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Lemonldap-ngDebian LinuxLemonldap-ng Lemonldap
Timeline
PublishedJul 18
Latest updateJul 19

Description

An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos authentication method combined with another method with the Combination authentication plug-in, any password will be recognized as valid for an existing user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶debiandebian/lemonldap-ng< lemonldap-ng 2.0.14+ds-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

Patch: gitlab.ow2.org ↗Patch: gitlab.ow2.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-gvrq-49rv-2rq7: An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2↗2022-07-19
▶
OSV
CVE-2021-40874: An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2↗2022-07-18
▶

📋Vendor Advisories

1
Debian
CVE-2021-40874: lemonldap-ng - An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using t...↗2021
▶