CVE-2023-44469 — Server-Side Request Forgery in Lemonldap

CWE-918 — Server-Side Request Forgery4 documents4 sources
Severity
4.3MEDIUMNVD
OSV5.3
EPSS
0.4%
top 36.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Lemonldap-ng LemonldapDebian Lemonldap-ng
Timeline
PublishedSep 29

Description

A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶debiandebian/lemonldap-ng< lemonldap-ng 2.16.1+ds-deb12u2 (bookworm)

Patches

Patch: gitlab.ow2.org ↗Patch: gitlab.ow2.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-fmg2-2hq5-5jxf: A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2↗2023-09-29
▶
OSV
CVE-2023-44469: A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2↗2023-09-29
▶

📋Vendor Advisories

1
Debian
CVE-2023-44469: lemonldap-ng - A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::N...↗2023
▶