GCVE - cpe:2.3:a:lemonldap-ng:lemonldap\:\::*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lemonldap-ng:lemonldap\:\::*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Lemonldap Ng (`3c4c4df5-7197-5da2-99ed-078be3118e65`)
Product	Lemonldap:: (`35b04c39-ed90-51a4-92fd-9f3c7fa59186`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-15941`	vulnerable	2026-06-08 05:13:07.166104	Details available OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs. Published: 2019-09-25T19:39:40.000Z Updated: 2024-08-05T01:03:32.341Z Open on db.gcve.eu Reference links https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1881 https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-6-is-out/ https://www.debian.org/security/2019/dsa-4533 https://seclists.org/bugtraq/2019/Sep/46	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13031`	vulnerable	2026-06-08 05:12:40.798850	Details available LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule. Published: 2019-06-28T22:42:10.000Z Updated: 2024-08-04T23:41:10.000Z Open on db.gcve.eu Reference links https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1820 https://lists.debian.org/debian-lts-announce/2019/07/msg00003.html https://www.calypt.com/blog/index.php/cve-2019-13031-xxe-on-lemonldapng-2-0-5/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6426`	vulnerable	2026-06-08 05:03:00.059201	Details available LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data. Published: 2013-01-01T15:00:00.000Z Updated: 2024-09-16T19:41:54.777Z Open on db.gcve.eu Reference links http://jira.ow2.org/browse/LEMONLDAP-570 http://openwall.com/lists/oss-security/2012/12/19/6 http://openwall.com/lists/oss-security/2012/12/20/6	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.