XSS Vulnerability in phpLDAPadmin: Risk of Malicious Value Execution
Summary
CVE-2020-35132: An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php. Affects phpldapadmin across 2 version ranges.
< 1.2.6.3-0.3
< c87571f6b7be15d5cd8b26381b6eb31ad03d28e2
Fixed in 1.2.6.3-0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpLDAPadmin is a web-based application used for managing LDAP directories. It provides a user-friendly interface for administrators to perform various tasks such as browsing and editing LDAP entries. Despite its utility, phpLDAPadmin has been found to have a critical vulnerability that allows users to store malicious values, potentially compromising the security of other users accessing the application.
Vulnerability Detail
An XSS (Cross-Site Scripting) vulnerability has been identified in phpLDAPadmin versions prior to 1.2.6.2. This flaw allows attackers to inject malicious scripts into the application, which can be executed by other users when they access the affected data. The vulnerability originates from the improper handling of user input in the get_request function located in lib/function.php. If exploited, this could lead to unauthorized actions being performed on behalf of the victim, data theft, or session hijacking.
How To Fix
Minimum fixed version
1.2.6.3-0.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpldapadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting access to the phpLDAPadmin interface to trusted users only. Additionally, ensure that input validation and sanitization are implemented to mitigate the risk of XSS attacks.
Conclusion
The XSS vulnerability in phpLDAPadmin poses a significant risk to users by allowing the execution of malicious scripts. It is crucial to upgrade to the latest version to protect against potential attacks. Implementing temporary workarounds can help mitigate risks until an upgrade is possible.
See every vulnerability recorded for phpldapadmin →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a medium level of risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and session hijacking, compromising user accounts and sensitive information.
Yes, you can restrict access to the phpLDAPadmin interface and implement input validation and sanitization as temporary measures.
Versions of phpLDAPadmin prior to 1.2.6.2 are affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for phpldapadmin.
