LemonLDAP:NG User-Enumeration and Cross-Site Scripting Vulnerabilities

vendor:

LemonLDAP::NG

by:

SecurityFocus

7.5

CVSS

HIGH

User-Enumeration and Cross-Site Scripting

200

CWE

Product Name: LemonLDAP::NG

Affected Version From: 0.9.3.1

Affected Version To: 0.9.3.2

Patch Exists: YES

Related CWE: N/A

CPE: a:lemonldap-ng:lemonldap-ng

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

LemonLDAP:NG User-Enumeration and Cross-Site Scripting Vulnerabilities

LemonLDAP:NG is prone to a user-enumeration weakness and a cross-site scripting vulnerability. A remote attacker can exploit the user-enumeration weakness to enumerate valid usernames and then perform brute-force attacks; other attacks are also possible. The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mitigation:

Upgrade to LemonLDAP::NG 0.9.3.2 or later.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/33312/info

LemonLDAP:NG is prone to a user-enumeration weakness and a cross-site scripting vulnerability.

A remote attacker can exploit the user-enumeration weakness to enumerate valid usernames and then perform brute-force attacks; other attacks are also possible.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to LemonLDAP::NG 0.9.3.2 are vulnerable. 

http://www.example.com/index.pl?url=";><script>alert("You were hacked!")</script><br"