CVE-2021-40874
published 2022-07-18CVE-2021-40874: An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.03%
59.9th percentile
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos authentication method combined with another method with the Combination authentication plug-in, any password will be recognized as valid for an existing user.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | lemonldap-ng | < lemonldap-ng 2.0.14+ds-1 (bookworm) | lemonldap-ng 2.0.14+ds-1 (bookworm) |
| lemonldap-ng | lemonldap | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2021-40874: lemonldap-ng - An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using t...
vendor_debian·2021·CVSS 9.8
CVE-2021-40874 [CRITICAL] CVE-2021-40874: lemonldap-ng - An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using t...
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos authentication method combined with another method with the Combination authentication plug-in, any password will be recognized as valid for an existing user.
Scope: local
bookworm: resolved (fixed in 2.0.14+ds-1)
bullseye: resolved (fixed in 2.0.11+ds-4+deb11u1)
forky: resolved (fixed in 2.0.14+ds-1)
sid: resolved (fixed in 2.0.14+ds-1)
trixie: resolved (fixed in 2.0.14+ds-1)
GHSA
GHSA-gvrq-49rv-2rq7: An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2
ghsa_unreviewed·2022-07-19
CVE-2021-40874 [CRITICAL] CWE-287 GHSA-gvrq-49rv-2rq7: An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos authentication method combined with another method with the Combination authentication plug-in, any password will be recognized as valid for an existing user.
OSV
CVE-2021-40874: An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2
osv·2022-07-18·CVSS 9.8
CVE-2021-40874 [CRITICAL] CVE-2021-40874: An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos authentication method combined with another method with the Combination authentication plug-in, any password will be recognized as valid for an existing user.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-07-18
Published