CVE-2024-45160

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty...

Original description

The description as published by the source.

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret).

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-45160 lemonldap-ng Fixed in: 2.19.2+ds-1

References

advisory github.com
advisory nvd.nist.gov
patch gitlab.ow2.org
patch gitlab.ow2.org
patch gitlab.ow2.org
report gitlab.ow2.org
web gitlab.ow2.org