CVE-2024-9101

EUVD-2024-50428
A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NCSC.chCNA
2.1 LOW
NETWORK
HIGH
NONE
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
phpldapadmin_projectphpldapadmin
1.2.1
CNA
phpldapadmin_projectphpldapadmin
1.2.6.7
CNA
Debian logo
Debian Releases
Debian Product
Codename
phpldapadmin
bookworm
postponed
bullseye
postponed
forky
1.2.6.7-4
fixed
sid
1.2.6.7-4
fixed
trixie
1.2.6.7-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
phpldapadmin
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/leenooks/phpLDAPadmin/blob/master/htdocs/entry_chooser.php
https://github.com/leenooks/phpLDAPadmin/commit/f713afc8d164169516c91b0988531f2accb9bce6#diff-c2d6d7678ada004e704ee055169395a58227aaec86a6f75fa74ca18ff49bca44R27
https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.1/
https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/