Описание
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| lemonldap-ng | fixed | 2.0.6+ds-1 | package | |
| lemonldap-ng | ignored | stretch | package | |
| lemonldap-ng | not-affected | jessie | package |
Примечания
Vulnerability exists pre-2.0 versions, but as restrictions on OIDC federation
were added only in 2.0 the vulnerability has no effect. The vulnerability
itself exists only with versions >= 1.9.0 (as there is no OIDC before)
EPSS
Связанные уязвимости
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
Уязвимость системы аутентификации для веб-приложений LemonLDAP::NG, связанная с неправильной авторизацией, позволяющая нарушителю получить несанкционированный доступ к информации и нарушить ее целостность и доступность
EPSS