5.9

CVE-2022-37186

Exploit
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lemonldap-ng ≫ Lemonldap::ng Version < 2.0.15
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.73% 0.492
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html
Third Party Advisory
Mailing List
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4
Patch
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758
Patch
Vendor Advisory
Exploit
Issue Tracking
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15
Patch
Release Notes