CVE-2024-9101 LOW

CVE-2024-9101: phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php

Vendor Phpldapadmin
Product phpLDAPadmin
Weakness CWE-79 · XSS
Published December 19, 2024
Last update December 20, 2024
View on NVD All CVEs

CVSS base score

2.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

What the vulnerability does

01Description

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

Key dates

02Disclosure timeline

December 19, 2024 CVE published
December 20, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-11675 CodeAstro Hospital Management System Add Patient Details Page his_admin_register_patient.php cross site scripting CVE-2023-33332 WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS) CVE-2024-12521 Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-37101 WordPress WP Post Author plugin <= 3.6.7 - Cross Site Scripting (XSS) vulnerability CVE-2021-24530 Alojapro Widget <= 1.1.15 - Authenticated Stored Cross-Site Scripting (XSS)