CVE-2018-12421
CRITICALLTB Self Service Password <1.3 - Auth Bypass
Title source: llmDescription
LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.
Exploits (1)
References (3)
Scores
CVSS v3
9.8
EPSS
0.0098
EPSS Percentile
76.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-640
Status
published
Products (1)
ltb-project/ldap_tool_box_self_service_password
< 1.3
Published
Jun 14, 2018
Tracked Since
Feb 18, 2026