CVE-2024-9101

Description

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

Reserved 2024-09-23 | Published 2024-12-19 | Updated 2024-12-20 | Assigner NCSC.ch

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
affected

1.2.1
affected

1.2.6.7
affected

Credits

Andreas Pfefferle, Redguard AG finder

References

www.redguard.ch/...024/12/19/security-advisory-phpldapadmin/ third-party-advisory

github.com/...ommit/f713afc8d164169516c91b0988531f2accb9bce6

github.com/...LDAPadmin/blob/master/htdocs/entry_chooser.php

sourceforge.net/...pldapadmin/files/phpldapadmin-php5/1.2.1/

cve.org (CVE-2024-9101)

nvd.nist.gov (CVE-2024-9101)

Download JSON