CVE-2023-28862 — Improper Authentication in Lemonldap

CWE-287 — Improper Authentication4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 81.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Lemonldap-ng LemonldapDebian Lemonldap-ng
Timeline
PublishedMar 31

Description

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶debiandebian/lemonldap-ng< lemonldap-ng 2.16.1+ds-1 (bookworm)

Patches

Patch: gitlab.ow2.org ↗Patch: gitlab.ow2.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-r74q-xwhp-q6r9: An issue was discovered in LemonLDAP::NG before 2↗2023-03-31
▶
OSV
CVE-2023-28862: An issue was discovered in LemonLDAP::NG before 2↗2023-03-31
▶

📋Vendor Advisories

1
Debian
CVE-2023-28862: lemonldap-ng - An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generati...↗2023
▶