CVE-2024-9101

N/A

Beschreibung

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

CVE Details

CVSS v3.1 BewertungN/A

Veroffentlicht12/19/2024

Zuletzt geandert12/19/2024

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-79

Referenzen

https://github.com/leenooks/phpLDAPadmin/blob/master/htdocs/entry_chooser.php(vulnerability@ncsc.ch)

https://github.com/leenooks/phpLDAPadmin/commit/f713afc8d164169516c91b0988531f2accb9bce6#diff-c2d6d7678ada004e704ee055169395a58227aaec86a6f75fa74ca18ff49bca44R27(vulnerability@ncsc.ch)

https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.1/(vulnerability@ncsc.ch)

https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/(vulnerability@ncsc.ch)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.