by Kastro
Paper/Archive/CVE-2021-35473

CVE-2021-35473

lemonldap-ng lemonldap-ng — An issue was discovered in LemonLDAP::NG before 2.0.12.

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 35.3.353 × 207.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
lemonldap-ng< 2.0.122.0.12CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/tagsrefgitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2549