CVE-2020-16093

2022-07-1800:15:08

CWE-295

[email protected]

web.nvd.nist.gov

lemonldap::ng

x.509 certificate

net::ldaps

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

39.2%

JSON

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.

Affected configurations

Nvd

Node

lemonldap-nglemonldap\Match\ng

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
lemonldap-nglemonldap\cpe:2.3:a:lemonldap-ng:lemonldap\:\:ng:*:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*