CVE-2023-44469

EUVD-2023-48806
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
lemonldap-nglemonldap\
𝑥
< 2.17.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
lemonldap-ng
bookworm
2.16.1+ds-deb12u3
fixed
bullseye
2.0.11+ds-4+deb11u5
fixed
bullseye (security)
2.0.11+ds-4+deb11u6
fixed
sid
2.20.1+ds-1
fixed
trixie
2.20.1+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
lemonldap-ng
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
not-affected
trusty
ignored
xenial
needs-triage
Common Weakness Enumeration
References
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.17.1
https://lists.debian.org/debian-lts-announce/2023/10/msg00014.html
https://security.lauritz-holtmann.de/post/sso-security-ssrf/
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.17.1
https://lists.debian.org/debian-lts-announce/2023/10/msg00014.html
https://security.lauritz-holtmann.de/post/sso-security-ssrf/