Vulnerabilities > CVE-2019-15941 - Incorrect Authorization vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 6 | |
| OS | 1 |
Common Weakness Enumeration (CWE)
Nessus
| NASL family | Debian Local Security Checks |
| NASL id | DEBIAN_DSA-4533.NASL |
| description | It was discovered that the Lemonldap::NG web SSO system did not restrict OIDC authorization codes to the relying party. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 129365 |
| published | 2019-09-26 |
| reporter | This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/129365 |
| title | Debian DSA-4533-1 : lemonldap-ng - security update |