CVE-2021-35472

Katalog CVE

CVSS 8.8 · High EPSS 1,8%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada lemonldap-ng lemonldap, debian linux. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication attempts, an attacker might alternately be authenticated as one of two different users.

Rincian

Terbit di NVD

30 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/8d3b763b6af2b8a9c4ad2765fbfabffec8a73af5 patch · advisory pihak ketiga
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2539 exploit · patch · advisory pihak ketiga
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/tags patch · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4943 advisory pihak ketiga