CVE-2024-9101CWE-79

phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php

Low · published December 19, 2024

CVSS v4.0
2.1
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
EPSS
0.00495 · 41.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-12-19T13:41Z
EPSS history
Timeline
  • 19 DEC 13:41Z
    phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php
    cvelistv5