LemonLDAP::NG -2.0.3 has Incorrect Access Control.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LemonLDAP::NG -2.0.3 has Incorrect Access Control. (CVE-2019-12046)

Note that Nessus relies on the presence of the package as reported by the vendor.

Erratum: bad versions

An attack vector was discovered by lemonldap-ng developers. When the SAML or CAS service provider is enable and the administrator has chosen to store SAML/CAS tokens in the session database, an attacker can open an anonymous session to connect to any protected application that does not have specific access rules.

For Debian 8 'Jessie', this problem has been fixed in version 1.3.3-1+deb9u1.

We recommend that you upgrade your lemonldap-ng packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Lemonldap::NG web SSO system performed insufficient validation of session tokens if the 'tokenUseGlobalStorage'option is enabled, which could grant users with access to the main session database access to an anonymous session.

ID	Name	Product	Family	Severity
252481	Linux Distros Unpatched Vulnerability : CVE-2019-12046	Nessus	Misc.	critical
125266	Debian DLA-1790-1 : lemonldap-ng security update	Nessus	Debian Local Security Checks	critical
125097	Debian DSA-4446-1 : lemonldap-ng - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-12046

critical

Tenable Plugins

critical

critical

critical