CVE-2024-9101: A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows…

PriorityP412low2.1CVSS 4.0

AVNACHATPPRNUIAVCLVILVALSCLSILSALEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX

EPSS

0.47%

36.9th percentile

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	phpldapadmin	< phpldapadmin 1.2.6.7-4 (forky)	phpldapadmin 1.2.6.7-4 (forky)
phpldapadmin	phpldapadmin	—	—
phpldapadmin	phpldapadmin	—	—
phpldapadmin_project	phpldapadmin	>= 0 < 1.2.6.7-4	1.2.6.7-4
phpldapadmin_project	phpldapadmin	>= 0 < 1.2.6.7-4	1.2.6.7-4

CVSS provenance

nvdv4.02.1LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv2.1LOW

vendor_debian2.1LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.