Executive Summary

This vulnerability exists in lemonldap-ng up to version 2.23.0, specifically in an unknown function within the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm, which is part of the SAML Common Domain Cookie Endpoint component.

The issue arises when an attacker manipulates the 'url' argument, resulting in an open redirect vulnerability. This means that the application can be tricked into redirecting users to malicious external sites.

The attack can be performed remotely, and the exploit is publicly available. The vendor was informed early but did not respond.

Useful 0 Not Useful 0

Impact Analysis

The open redirect vulnerability can be exploited by attackers to redirect users to malicious websites without their consent.

This can lead to phishing attacks, where users may be tricked into providing sensitive information or downloading malware.

Since the attack can be carried out remotely, it poses a risk to any user interacting with the affected lemonldap-ng system.

Useful 0 Not Useful 0