Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php URI or the template parameter to the templates/3rdParty/pla/htdocs/cmd.php?cmd=rename_form URI.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the     templates/3rdParty/pla/htdocs/cmd.php URI or the template parameter to the     templates/3rdParty/pla/htdocs/cmd.php?cmd=rename_form URI. (CVE-2018-8763)

Note that Nessus relies on the presence of the package as reported by the vendor.

Michal Kedzior found two vulnerabilities in LDAP Account Manager, a web front-end for LDAP directories.

CVE-2018-8763

The found Reflected Cross Site Scripting (XSS) vulnerability might allow an attacker to execute JavaScript code in the browser of the victim or to redirect her to a malicious website if the victim clicks on a specially crafted link.

For Debian 7 'Wheezy', these problems have been fixed in version 3.7-2+deb7u1.

We recommend that you upgrade your ldap-account-manager packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Michal Kedzior found two vulnerabilities in LDAP Account Manager, a web front-end for LDAP directories.

  - CVE-2018-8763     The found Reflected Cross Site Scripting (XSS)     vulnerability might allow an attacker to execute     JavaScript code in the browser of the victim or to     redirect her to a malicious website if the victim clicks     on a specially crafted link.

  - CVE-2018-8764     The application leaks the CSRF token in the URL, which     can be use by an attacker to perform a Cross-Site     Request Forgery attack, in which a victim logged in LDAP     Account Manager might performed unwanted actions in the     front-end by clicking on a link crafted by the attacker.

ID	Name	Product	Family	Severity
254862	Linux Distros Unpatched Vulnerability : CVE-2018-8763	Nessus	Misc.	medium
108903	Debian DLA-1342-1 : ldap-account-manager security update	Nessus	Debian Local Security Checks	medium
108817	Debian DSA-4165-1 : ldap-account-manager - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-8763

medium

Tenable Plugins

medium

medium

high