CVE-2020-16093 - Vulnerability Details - OpenCVE

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Lemonldap-ng	Lemonldap\

Configuration 1 [-]

cpe:2.3:a:lemonldap-ng:lemonldap\:\:ng:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2250
https://lemonldap-ng.org/download
https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-07-17T00:00:00

Updated: 2024-08-04T13:37:53.067Z

Reserved: 2020-07-28T00:00:00

Link: CVE-2020-16093

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-07-18T00:15:08.193

Modified: 2024-11-21T05:06:45.193

Link: CVE-2020-16093

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lemonldap-ng:lemonldap\\:\\:ng:*:*:*:*:*:*:*:*", "matchCriteriaId": "48651E05-4737-4A53-8DE4-2C9D0CEC6C1A", "versionEndIncluding": "2.0.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used."}, {"lang": "es", "value": "En LemonLDAP::NG (tambi\u00e9n se conoce como lemonldap-ng) versiones hasta 2.0.8, la validez del certificado X.509 no es comprobada por defecto cuando es conectado a backends LDAP remotos, porque es usada la configuraci\u00f3n por defecto del m\u00f3dulo Net::LDAPS para Perl"}], "id": "CVE-2020-16093", "lastModified": "2024-11-21T05:06:45.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-18T00:15:08.193", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2250"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://lemonldap-ng.org/download"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2250"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://lemonldap-ng.org/download"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}]}