CVE-2024-9101

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
NCSC.chCNA
---
---
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
Debian logo
Debian Releases
Debian Product
Codename
phpldapadmin
bookworm
postponed
bullseye
postponed
sid
1.2.6.7-4
fixed
trixie
1.2.6.7-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
phpldapadmin
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/leenooks/phpLDAPadmin/blob/master/htdocs/entry_chooser.php
https://github.com/leenooks/phpLDAPadmin/commit/f713afc8d164169516c91b0988531f2accb9bce6#diff-c2d6d7678ada004e704ee055169395a58227aaec86a6f75fa74ca18ff49bca44R27
https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.1/
https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/