VulnerabilityModified
CVE-2022-37186
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting.
MEDIUM 5.9EPSS 0.73%
Does this matter?
Lower severity and a low EPSS score (0.73%). Track it; it rarely justifies an emergency change on its own.
Description
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.73% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-613
- Affected
- lemonldap-ng/lemonldap\
- Source
- cve@mitre.org
References
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4Patch
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758Exploit, Issue Tracking, Patch, Vendor Advisory
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15Patch, Release Notes
- https://lists.debian.org/debian-lts-announce/2023/01/msg00027.htmlMailing List, Third Party Advisory
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4Patch
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758Exploit, Issue Tracking, Patch, Vendor Advisory
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15Patch, Release Notes
- https://lists.debian.org/debian-lts-announce/2023/01/msg00027.htmlMailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.