CVE-2020-36659

2023-01-2705:15:17

CWE-295

[email protected]

web.nvd.nist.gov

apache

session

browseable

cve-2020-36659

ldap

x.509

certificate

vulnerability

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.

Affected configurations

Nvd

Node

lemonldap-ngapache\Match\session\\browsable

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
lemonldap-ngapache\cpe:2.3:a:lemonldap-ng:apache\:\:session\:\:browsable:*:*:*:*:*:perl:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lemonldap-ng	apache\		cpe:2.3:a:lemonldap-ng:apache\:\:session\:\:browsable::::::perl::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*