CVE-2004-2254: High severity Netwin Surgeldap vulnerability
SurgeLDAP 1.0g (Build 12), and possibly other versions before 1.0h, allows remote attackers to bypass authentication for the administration interface via a direct request to admin.cgi with a modified utoken parameter.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2254?
CVE-2004-2254 is considered to be a high severity vulnerability due to its ability to allow unauthorized access to the administration interface.
How do I fix CVE-2004-2254?
To fix CVE-2004-2254, upgrade SurgeLDAP to version 1.0h or later that addresses this authentication bypass issue.
Which versions of SurgeLDAP are affected by CVE-2004-2254?
CVE-2004-2254 affects SurgeLDAP versions 1.0a through 1.0g.
What type of attack is associated with CVE-2004-2254?
CVE-2004-2254 is associated with remote authentication bypass attacks that compromise the security of the admin interface.
Can CVE-2004-2254 be exploited without authentication?
Yes, CVE-2004-2254 can be exploited by attackers without authentication through directly modifying the utoken parameter.