lemonldap-ng

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

lemonldap-ng records in CISA KEV

No lemonldap-ng vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Lemonldap 13 records HIGH Apache 2 records LOW

Records

17 records

TI-2023-13366 CVE-2023-28862 · GHSA-r74q-xwhp-q6r9

An issue was discovered in LemonLDAP::NG before 2.16.1.

HIGH 82

An issue was discovered in LemonLDAP::NG before 2.16.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00957 Published 2023-03-31 No fix listed CWE-287

TI-2024-32628 CVE-2024-48933 · GHSA-vp6w-3fx2-4f2w

A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default val…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00327 Published 2024-10-09 No fix listed CWE-79

TI-2022-17335 CVE-2022-37186 · GHSA-x33x-q828-vc8w

In LemonLDAP::NG before 2.0.15.

MEDIUM 60

In LemonLDAP::NG before 2.0.15.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00731 Published 2023-04-16 No fix listed CWE-613

TI-2023-23963 CVE-2023-44469 · GHSA-fmg2-2hq5-5jxf

A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before…

MEDIUM 53

A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00747 Published 2023-09-29 No fix listed CWE-918

TI-2019-14263 CVE-2019-19791 · GHSA-c639-6g37-r8wm

In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server…

MEDIUM 50

In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG setup options are used).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00782 Published 2023-05-29 No fix listed

TI-2019-09012 CVE-2019-12046 · GHSA-2gh8-gx83-42h9

LemonLDAP::NG -2.0.3 has Incorrect Access Control.

MEDIUM 48

LemonLDAP::NG -2.0.3 has Incorrect Access Control.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03133 Published 2019-05-22 No fix listed CWE-522

TI-2020-15127 CVE-2020-24660 · GHSA-x44x-r84w-8v67

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used.

MEDIUM 47

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02463 Published 2020-09-14 Fixed in 0.5.2 CWE-425

TI-2019-11985 CVE-2019-15941 · GHSA-jq88-5p5w-x8c3

OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass…

MEDIUM 47

OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02461 Published 2019-09-25 No fix listed CWE-863

TI-2021-17795 CVE-2021-40874 · GHSA-gvrq-49rv-2rq7

An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13.

MEDIUM 44

An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01187 Published 2022-07-17 No fix listed CWE-287

TI-2021-14213 CVE-2021-35472 · GHSA-9v87-664x-72qc

An issue was discovered in LemonLDAP::NG before 2.0.12.

MEDIUM 42

An issue was discovered in LemonLDAP::NG before 2.0.12.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01801 Published 2021-07-27 No fix listed CWE-307

TI-2019-09764 CVE-2019-13031 · GHSA-wxgq-mv23-pgqr

LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a…

MEDIUM 40

LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.02361 Published 2019-06-28 No fix listed CWE-611

TI-2025-37054 CVE-2025-59518 · GHSA-fxqv-qm7m-363x

OS command injection in lemonldap-ng LemonLDAP::NG

LOW 39

In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.01146 Published 2025-09-17 Fixed in 2.16.7, 2.21.3 CWE-78

TI-2025-22682 CVE-2025-31510 · GHSA-55mm-vp96-5r7h

Cross-site scripting in lemonldap-ng LemonLDAP::NG

LOW 38

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00375 Published 2026-01-16 Fixed in 2.16.5, 2.21.0 CWE-79

TI-2020-18852 CVE-2020-36659 · GHSA-crqh-wr78-6jgr

In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not…

LOW 38

In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is use…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00445 Published 2023-01-27 No fix listed CWE-295

TI-2020-18851 CVE-2020-36658 · GHSA-qf7m-fmfh-9c8v

In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by…

LOW 38

In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00462 Published 2023-01-27 No fix listed CWE-295

TI-2012-05173 CVE-2012-6426 · GHSA-9q8m-r734-6gg5

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the…

LOW 36

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01552 Published 2013-01-01 No fix listed CWE-264

TI-2020-12663 CVE-2020-16093 · GHSA-9c48-27fx-7952

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is…

LOW 34

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0078 Published 2022-07-17 No fix listed CWE-295

Open these records in search →

Critical	6
High	8
Medium	3
Low	0
No CVSS	0