CVE-2022-37186: Medium severity lemonldap::ng vulnerability
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-37186?
The severity of CVE-2022-37186 is rated as medium with a CVSS score of 5.9.
How can I mitigate CVE-2022-37186?
To mitigate CVE-2022-37186, users are recommended to update LemonLDAP::NG to version 2.0.15 or later.
What can happen if LemonLDAP::NG sessions are not deleted according to the timeoutActivity setting?
If sessions are not deleted as intended, it can result in sessions not being cleared automatically leading to potential security risks and data exposure.
Is CVE-2022-37186 related to manual session removal in LemonLDAP::NG?
CVE-2022-37186 in LemonLDAP::NG is related to situations where manual removal of a session before it should be automatically deleted can cause sessions to not be cleared as expected.