CVE-2024-9101

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

CVSS

No CVSS.

References

Link	Resource
https://github.com/leenooks/phpLDAPadmin/blob/master/htdocs/entry_chooser.php
https://github.com/leenooks/phpLDAPadmin/commit/f713afc8d164169516c91b0988531f2accb9bce6#diff-c2d6d7678ada004e704ee055169395a58227aaec86a6f75fa74ca18ff49bca44R27
https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.1/
https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/

Configurations

No configuration.

History

No history.

Information

Published : 2024-12-19 14:15

Updated : 2026-06-17 08:23

NVD link : CVE-2024-9101

Mitre link : CVE-2024-9101

CVE.ORG link : CVE-2024-9101

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-9101", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-9101", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-12-20T20:20:12.468228Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"repo": "https://github.com/leenooks/phpLDAPadmin", "vendor": "phpLDAPadmin", "product": "phpLDAPadmin", "versions": [{"status": "affected", "version": "1.2.1"}, {"status": "affected", "version": "1.2.6.7"}], "platforms": ["All platforms supporting phpLDAPadmin"], "programFiles": ["htdocs/entry_chooser.php"], "collectionURL": "https://github.com/leenooks/phpLDAPadmin/releases", "defaultStatus": "affected"}]}], "published": "2024-12-19T14:15:06.147", "references": [{"url": "https://github.com/leenooks/phpLDAPadmin/blob/master/htdocs/entry_chooser.php", "source": "vulnerability@ncsc.ch"}, {"url": "https://github.com/leenooks/phpLDAPadmin/commit/f713afc8d164169516c91b0988531f2accb9bce6#diff-c2d6d7678ada004e704ee055169395a58227aaec86a6f75fa74ca18ff49bca44R27", "source": "vulnerability@ncsc.ch"}, {"url": "https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.1/", "source": "vulnerability@ncsc.ch"}, {"url": "https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) reflejado en el 'Entry Chooser' de phpLDAPadmin (versi\u00f3n 1.2.1 hasta la \u00faltima versi\u00f3n, 1.2.6.7) permite a los atacantes ejecutar c\u00f3digo JavaScript arbitrario en el navegador del usuario a trav\u00e9s del par\u00e1metro 'element', que se pasa de forma no segura a la funci\u00f3n 'eval' de JavaScript. Sin embargo, la explotaci\u00f3n se limita a condiciones espec\u00edficas en las que 'opener' est\u00e1 configurado correctamente."}], "lastModified": "2026-06-17T08:23:57.430", "sourceIdentifier": "vulnerability@ncsc.ch"}