CVE-2019-19791 Missing authorization in n/a

Critical 9.8 Published 29 May 2023 Updated 14 Jan 2025

Attackers can bypass access controls on SOAP/REST endpoints by manipulating URLs, potentially exposing sensitive management functions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-19791?

CVE-2019-19791 is a critical missing authorization vulnerability in n/a, published on 29 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG setup options are used). For example, an attacker can insert index.fcgi/index.fcgi into a URL to bypass a Require directive.

Which versions are affected by CVE-2019-19791?

It affects 1 product.

Products include Lemonldap-Ng Lemonldap\.

How do I fix CVE-2019-19791?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-19791 being exploited?

There is no known exploitation of CVE-2019-19791 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2019-19791, GHSA-c639-6g37-r8wm, UBUNTU-CVE-2019-19791.