An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the Lemonldap::NG handler for Node.js package.
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Lemonldap::ng | Lemonldap-ng | * | 2.0.8 (including) |
| Lemonldap::ng_handler | Lemonldap-ng | * | 0.5.2 (including) |
| Lemonldap-ng | Ubuntu | bionic | * |
| Lemonldap-ng | Ubuntu | groovy | * |
| Lemonldap-ng | Ubuntu | trusty | * |
| Lemonldap-ng | Ubuntu | upstream | * |
| Lemonldap-ng | Ubuntu | xenial | * |