Vulnerability · Published Mar 31, 2023 · Assigned by mitre
CVE-2023-28862
Critical 9.8
In plain English
A critical-severity improper authentication in the lemonldap-ng package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | lemonldap-ng | 2.16.1+ds-1 | DEBIAN-CVE-2023-28862 |
| Debian:13 | lemonldap-ng | 2.16.1+ds-1 | DEBIAN-CVE-2023-28862 |
| Debian:14 | lemonldap-ng | 2.16.1+ds-1 | DEBIAN-CVE-2023-28862 |
| Ubuntu:22.04:LTS | lemonldap-ng | no fix listed | UBUNTU-CVE-2023-28862 |
| Ubuntu:24.04:LTS | lemonldap-ng | no fix listed | UBUNTU-CVE-2023-28862 |
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H