CVE-2022-37186

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-37186
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4 Patch
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758 Exploit Issue Tracking Patch Vendor Advisory
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15 Patch Release Notes
https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html Mailing List Third Party Advisory
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4 Patch
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758 Exploit Issue Tracking Patch Vendor Advisory
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15 Patch Release Notes
https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lemonldap-ng:lemonldap\:\:ng:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:14

Type Values Removed Values Added
References () https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4 - Patch () https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4 - Patch
References () https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758 - Exploit, Issue Tracking, Patch, Vendor Advisory () https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758 - Exploit, Issue Tracking, Patch, Vendor Advisory
References () https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15 - Patch, Release Notes () https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15 - Patch, Release Notes
References () https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html - Mailing List, Third Party Advisory

26 Apr 2023, 16:30

Type Values Removed Values Added
CWE CWE-613
CPE cpe:2.3:a:lemonldap-ng:lemonldap\:\:ng:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.9
References (MISC) https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html - (MISC) https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html - Mailing List, Third Party Advisory
References (MISC) https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758 - (MISC) https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758 - Exploit, Issue Tracking, Patch, Vendor Advisory
References (MISC) https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4 - (MISC) https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4 - Patch
References (CONFIRM) https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15 - (CONFIRM) https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15 - Patch, Release Notes

17 Apr 2023, 13:12

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-16 02:15

Updated : 2025-02-06 19:15

NVD link : CVE-2022-37186

Mitre link : CVE-2022-37186

CVE.ORG link : CVE-2022-37186

JSON object : View

Products Affected

lemonldap-ng

  • lemonldap\
CWE
CWE-613

Insufficient Session Expiration