CVE-2020-24660

Katalog CVE

CVSS 9.8 · Critical EPSS 2,4%

Kerentanan Direct Request ('Forced Browsing') pada lemonldap-ng lemonldap, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

Rincian

Terbit di NVD

14 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-425: Direct Request ('Forced Browsing')

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2 advisory pihak ketiga
• https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67 advisory pihak ketiga
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290 exploit · advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4762 advisory pihak ketiga