p PatchFirst

CVE-2024-9101

CVE-2024-9101 · phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

CVSS 2.1 · Low · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • phpldapadmin

    Versions
    • 1.2.1: Affected
    • 1.2.6.7: Affected

    No fix published

  • phpldapadmin Debian:12

    Versions
    • 1.2.6.3-0.3
    • 1.2.6.3-0.3+deb12u1
    • 1.2.6.6-1
    • 1.2.6.6-2
    • 1.2.6.7-1
    • 1.2.6.7-2
    • 1.2.6.7-2~bpo12+1
    • 1.2.6.7-3
    • 1.2.6.7-3~bpo12+1
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.2.6.7-4

    Update to 1.2.6.7-4

  • phpldapadmin Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.2.6.7-4

    Update to 1.2.6.7-4

  • phpldapadmin Ubuntu:16.04:LTS

    Versions
    • 1.2.2-5.2
    • 1.2.2-5.2ubuntu1
    • 1.2.2-5.2ubuntu2
    • 1.2.2-5.2ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:18.04:LTS

    Versions
    • 1.2.2-6ubuntu1
    • 1.2.2-6ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:20.04:LTS

    Versions
    • 1.2.2-6.1ubuntu1
    • 1.2.2-6.2ubuntu1
    • 1.2.2-6.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:22.04:LTS

    Versions
    • 1.2.2-6.3
    • 1.2.6.3-0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:24.04:LTS

    Versions
    • 1.2.6.3-0.3
    • 1.2.6.6-2
    • 1.2.6.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:25.10

    Versions
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:26.10

    Versions
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpldapadmin Ubuntu:26.04:LTS

    Versions
    • 1.2.6.7-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →