Lucene search

MitreCVE-2018-12421

HistoryJun 14, 2018 - 7:29 p.m.

CVE-2018-12421

2018-06-1419:29:00

CWE-640

mitre

web.nvd.nist.gov

ltb

ldap tool box

self service

password change

unauthorized access

vulnerability

cve-2018-12421

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.005

Percentile

77.5%

JSON

LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.

Affected configurations

Nvd

Node

ltb-projectldap_tool_box_self_service_passwordRange<1.3

VendorProductVersionCPE
ltb-projectldap_tool_box_self_service_password*cpe:2.3:a:ltb-project:ldap_tool_box_self_service_password:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ltb-project	ldap_tool_box_self_service_password	*	cpe:2.3:a:ltb-project:ldap_tool_box_self_service_password::::::::

References

github.com/ltb-project/self-service-password/issues/209

github.com/ltb-project/self-service-password/issues/211

lists.ltb-project.org/pipermail/ltb-announce/2018-June/000023.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.005

Percentile

77.5%

JSON

Related for CVE-2018-12421