CVE-2024-9101
phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php
Summary
phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php
Original description
The description as published by the source.
A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-9101 phpldapadmin
- Ubuntu UBUNTU-CVE-2024-9101 phpldapadmin
References
- advisory github.com
- advisory nvd.nist.gov
- advisory redguard.ch
- package github.com
- package github.com
- patch github.com
- web github.com
- web sourceforge.net