CVE-2024-9101: phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php

Q: What is the severity of CVE-2024-9101?

The severity of CVE-2024-9101 is classified as medium due to its ability to execute arbitrary JavaScript in a user's browser.

Q: How do I fix CVE-2024-9101?

To fix CVE-2024-9101, upgrade phpLDAPadmin to version 1.2.6.8 or later, which addresses this vulnerability.

Q: Which versions of phpLDAPadmin are affected by CVE-2024-9101?

CVE-2024-9101 affects phpLDAPadmin versions from 1.2.1 through 1.2.6.7.

Q: What type of vulnerability is CVE-2024-9101?

CVE-2024-9101 is a reflected cross-site scripting (XSS) vulnerability.

Q: What can attackers achieve with CVE-2024-9101?

Attackers can execute arbitrary JavaScript code in the user's browser, potentially leading to data theft or session hijacking.

Published Dec 19, 2024

Updated

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

Affected Software

1 affected component

phpLDAPadmin phpLDAPadmin>=1.2.1<=1.2.6.7

Remediation

Information

It is recommended to avoid using the eval() function, especially in combination with user-supplied input. Instead of using eval(), it is advised to access the DOM element directly in a safe manner.

Event History

Dec 19, 2024

CVE Published

via MITRE·01:41 PM

Data Sourced

via MITRE·01:41 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-9101?

The severity of CVE-2024-9101 is classified as medium due to its ability to execute arbitrary JavaScript in a user's browser.

How do I fix CVE-2024-9101?