CVE-2020-35132
MEDIUMphpldapadmin < 1.2.6.2 - Stored Cross-Site Scripting via get_request in lib/function.php
Title source: llmDescription
An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.
References (6)
Core 6
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugs.launchpad.net/ubuntu/+source/phpldapadmin/+bug/1906474
Patch, Third Party Advisory x_refsource_misc
https://github.com/leenooks/phpLDAPadmin/commit/c87571f6b7be15d5cd8b26381b6eb31ad03d28e2
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/leenooks/phpLDAPadmin/issues/130
Patch, Third Party Advisory x_refsource_misc
https://github.com/leenooks/phpLDAPadmin/compare/1.2.5...1.2.6.2
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XA42XDSUPCOXL5ZCP5RGD3FD4JQQWNX/
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6PZH3EY2T66N2MGOA7DWCAIVYIJH4BC/
Scores
CVSS v3
5.4
EPSS
0.0132
EPSS Percentile
67.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (3)
fedoraproject/fedora
32
fedoraproject/fedora
33
phpldapadmin_project/phpldapadmin
< 1.2.6.2
Published
Dec 11, 2020
Tracked Since
Feb 18, 2026