CVE-2021-35473: Critical severity LemonLDAP NG vulnerability
An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-35473?
CVE-2021-35473 is rated as a moderate severity vulnerability due to the potential unauthorized access it allows using expired tokens.
How do I fix CVE-2021-35473?
To fix CVE-2021-35473, upgrade LemonLDAP::NG to version 2.0.12 or later to ensure the expiration check for OAuth2.0 tokens is implemented.
What versions are affected by CVE-2021-35473?
CVE-2021-35473 affects LemonLDAP::NG versions from 2.0.4 to 2.0.11.
What type of attack is enabled by CVE-2021-35473?
CVE-2021-35473 enables an attacker to access the OAuth2.0 handler using expired access tokens if no expiration check is in place.
Is CVE-2021-35473 related to OAuth2.0 security?
Yes, CVE-2021-35473 directly relates to OAuth2.0 security by exploiting a missing expiration check for access tokens.