An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the Lemonldap::NG handler for Node.js package.
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Lemonldap::ng | Lemonldap-ng | * | 2.0.8 (including) |
| Lemonldap::ng_handler | Lemonldap-ng | * | 0.5.2 (including) |