CVE-2023-44469

A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requ...

Original description

The description as published by the source.

A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-44469 lemonldap-ng Fixed in: 2.0.11+ds-4+deb11u5

References

advisory github.com
advisory nvd.nist.gov
report gitlab.ow2.org
web gitlab.ow2.org
web security.lauritz-holtmann.de
web lists.debian.org