CVEvulnerability
CVE-2023-44469
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-09-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-918
Description
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.
Affected configurations
• lemonldap-ng lemonldap\ \ (< 2.17.1)
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998 Issue Tracking, Patch, Vendor Advisory
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.17.1 Issue Tracking, Release Notes
- https://lists.debian.org/debian-lts-announce/2023/10/msg00014.html lists.debian.org
- https://security.lauritz-holtmann.de/post/sso-security-ssrf/ Not Applicable
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998 Issue Tracking, Patch, Vendor Advisory
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.17.1 Issue Tracking, Release Notes
- https://lists.debian.org/debian-lts-announce/2023/10/msg00014.html lists.debian.org
- https://security.lauritz-holtmann.de/post/sso-security-ssrf/ Not Applicable