CVE-2022-37186

MEDIUM EPSS 49.4%
Published Apr 16, 20233y ago · Modified Jun 17, 20262w ago
5.9 CVSS 3.1
Medium
Find Similar
Published Apr 16, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.

CVSS Details

Base Score
5.9
Exploitability
2.2
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
49.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-613

Affected Products 1

VendorProductVersionRange
lemonldap-nglemonldap\\ <2.0.15

References 4

  • gitlab.ow2.org https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4
    Patch
  • gitlab.ow2.org https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758
    ExploitIssue TrackingPatchVendor Advisory
  • gitlab.ow2.org https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15
    PatchRelease Notes
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html
    Mailing ListThird Party Advisory

Remediation

  • gitlab.ow2.org https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4
    Patch
  • gitlab.ow2.org https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758
    ExploitIssue TrackingPatchVendor Advisory
  • gitlab.ow2.org https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15
    PatchRelease Notes