CVE-2023-44469

2023-09-2907:15:14

Debian Security Bug Tracker

security-tracker.debian.org

server-side request forgery

lemonldap::ng

openid connect

0.001 Low

EPSS

Percentile

22.6%

JSON

A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.

OSVersionArchitecturePackageVersionFilename
Debian12alllemonldap-ng< 2.16.1+ds-deb12u2lemonldap-ng_2.16.1+ds-deb12u2_all.deb
Debian11alllemonldap-ng< 2.0.11+ds-4+deb11u5lemonldap-ng_2.0.11+ds-4+deb11u5_all.deb
Debian10alllemonldap-ng< 2.0.2+ds-7+deb10u10lemonldap-ng_2.0.2+ds-7+deb10u10_all.deb
Debian999alllemonldap-ng< 2.17.1+ds-1lemonldap-ng_2.17.1+ds-1_all.deb
Debian13alllemonldap-ng< 2.17.1+ds-1lemonldap-ng_2.17.1+ds-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	lemonldap-ng	< 2.16.1+ds-deb12u2	lemonldap-ng_2.16.1+ds-deb12u2_all.deb
Debian	11	all	lemonldap-ng	< 2.0.11+ds-4+deb11u5	lemonldap-ng_2.0.11+ds-4+deb11u5_all.deb
Debian	10	all	lemonldap-ng	< 2.0.2+ds-7+deb10u10	lemonldap-ng_2.0.2+ds-7+deb10u10_all.deb
Debian	999	all	lemonldap-ng	< 2.17.1+ds-1	lemonldap-ng_2.17.1+ds-1_all.deb
Debian	13	all	lemonldap-ng	< 2.17.1+ds-1	lemonldap-ng_2.17.1+ds-1_all.deb