CVE-2019-15941
First published: Wed Sep 25 2019(Updated: )
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/lemonldap-ng | 2.0.2+ds-7+deb10u7 2.0.2+ds-7+deb10u10 2.0.11+ds-4+deb11u5 2.16.1+ds-deb12u2 2.17.1+ds-1 | |
| LemonLDAP::NG | >=2.0.0<=2.0.5 | |
| Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-15941?
The severity of CVE-2019-15941 is rated as critical with a CVSS score of 9.8.
How can an attacker bypass access control rules in LemonLDAP::NG 2.x through 2.0.5 via CVE-2019-15941?
An attacker can bypass access control rules by sending a crafted OpenID Connect authorization request to exploit the vulnerability.
What software versions are affected by CVE-2019-15941?
LemonLDAP::NG versions 2.0.0 to 2.0.5 are affected, along with specific Debian Linux versions.
Are there any known remediation versions for CVE-2019-15941?
Remediation versions include LemonLDAP::NG 2.0.2+ds-7+deb10u7, 2.0.2+ds-7+deb10u10, 2.0.11+ds-4+deb11u5, 2.16.1+ds-deb12u2, and 2.17.1+ds-1.
Where can I find more information about CVE-2019-15941?
For more information, you can refer to the provided references: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1881, https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-6-is-out/, and https://seclists.org/bugtraq/2019/Sep/46.
- collector/security-tracker-debian
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/lemonldap-ng
- canonical/lemonldap::ng
- version/lemonldap::ng/2.0.0
- version/lemonldap::ng/2.0.5
- vendor/debian
- canonical/debian linux
- version/debian linux/10.0