CVE-2024-9101 phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php
Reflected XSS in phpLDAPadmin allows arbitrary JavaScript execution via the element parameter, requiring specific opener conditions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-9101?
CVE-2024-9101 is a low-severity cross-site scripting vulnerability in phpLDAPadmin, published on 19 Dec 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.
Weakness: CWE-79
Which versions are affected by CVE-2024-9101?
How do I fix CVE-2024-9101?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-9101 being exploited?
There is no known exploitation of CVE-2024-9101 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-9101, GHSA-6mpf-h5jc-fvrw, UBUNTU-CVE-2024-9101.