GitHub Advisoryadvisory · npm
GHSA-x44x-r84w-8v67 Lack of URL normalization may lead to authorization bypass when URL access rules are used
MEDIUM
Official page ↗
- Aliases
- CVE-2020-24660
- Ecosystem
- npm
- Packages
- lemonldap-ng-handler
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-287
- Reviewed
- 2020-09-09
Affected packages
• npm lemonldap-ng-handler: < 0.5.2 → fixed in 0.5.2
Description
Impact
When access rules are used inside a protected host, some URL encodings may bypass filtering system.
Patches
Version 0.5.2 includes a patch that fixes the vulnerability
Workarounds
No way for users to fix or remediate the vulnerability without upgrading
References
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290
For more information
If you have any questions or comments about this advisory:
• Open an issue in this repository or LemonLDAP::NG GitLab
• Email us at [email protected]
Related
Alias · CVE (1)
- CVE-2020-24660 An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67 web
- https://nvd.nist.gov/vuln/detail/CVE-2020-24660 advisory
- https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/commit/136aa83ed431462fa42ce17b7f9b24e056de06be web
- https://github.com/LemonLDAPNG/node-lemonldap-ng-handler package
- https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2 web
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290 web
- https://snyk.io/vuln/SNYK-JS-NODELEMONLDAPNGHANDLER-655999 web
- https://www.debian.org/security/2020/dsa-4762 web
- https://www.npmjs.com/package/lemonldap-ng-handler web