CVE-2020-23148: High severity rconfig vulnerability
Published Aug 9, 2021
·Updated
The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request.
Affected Software
1 affected component
rConfig rConfig=3.9.5
Event History
Aug 9, 2021
CVE Published
via MITRE·10:54 PM
Data Sourced
via MITRE·10:54 PM
Description
Frequently Asked Questions
1
What is CVE-2020-23148?
CVE-2020-23148 refers to a vulnerability in rConfig 3.9.5 that allows attackers to perform LDAP injection and obtain sensitive information.
2
What is the severity of CVE-2020-23148?
CVE-2020-23148 has a severity rating of high (7.5).
3
How can an attacker exploit CVE-2020-23148?
An attacker can exploit CVE-2020-23148 by sending a crafted POST request to ldap/login.php with a malicious userLogin parameter.
4
What is the affected version of rConfig?
rConfig version 3.9.5 is affected by CVE-2020-23148.
5
How can I mitigate CVE-2020-23148?
To mitigate CVE-2020-23148, update rConfig to a version that addresses the vulnerability and sanitize input parameters in ldap/login.php.