XSS Vulnerability in phpLDAPadmin: A Security Risk for User Data
Summary
DEBIAN-CVE-2020-35132: An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php. Affects phpldapadmin versions < 1.2.6.3-0.3. Fixed in 1.2.6.3-0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpLDAPadmin is a web-based application used for managing LDAP directories. It provides a user-friendly interface for administrators to perform various LDAP operations, such as adding, modifying, and deleting entries. The application is widely used due to its ease of use and extensive features. However, prior to version 1.2.6.2, phpLDAPadmin was found to be vulnerable to cross-site scripting (XSS) attacks, which could compromise user data and application integrity.
Vulnerability Detail
An XSS issue has been discovered in phpLDAPadmin before version 1.2.6.2. This vulnerability allows users to store malicious values that may be executed by other users at a later time via the get_request function in lib/function.php. If exploited, this vulnerability could lead to unauthorized actions being performed on behalf of users, potentially exposing sensitive information and compromising the security of the application.
How To Fix
Minimum fixed version
1.2.6.3-0.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpldapadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using the affected version of phpLDAPadmin and refrain from executing any untrusted scripts or inputs until the application is updated to a secure version.
Conclusion
The XSS vulnerability in phpLDAPadmin poses a significant risk to user data and application security. It is crucial for users to update to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for phpldapadmin →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows malicious users to inject harmful scripts into the application.
If you are using a version prior to 1.2.6.2, your installation is vulnerable to this XSS issue.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and a compromise of user accounts.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpldapadmin.
