CVE catalog

CVE-2024-9101

phpldapadmin: CVE-2024-9101

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.50% · Oct 25, 2026

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphpldapadminsid1.2.6.7-4fixed
Debianphpldapadminforky1.2.6.7-4fixed
Debianphpldapadmintrixie1.2.6.7-4fixed
Debianphpldapadminbookworm1.2.6.3-0.3+deb12u1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphpldapadminsourcesid1.2.6.7-4not yet assignedNot reported[1090914]
Debianphpldapadminsourceforky1.2.6.7-4not yet assignedNot reported[1090914]
Debianphpldapadminsourcetrixie1.2.6.7-4not yet assignedNot reported[1090914]
Debianphpldapadminsourcebookworm(unfixed)not yet assignedNot reported[1090914]

[Debian bug #1090914]

Notes

[bookworm] phpldapadmin: Minor issue, revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [phpldapadmin]Affected
    Details (4)

    • 1.2.6.3-0.3+deb12u1 · all · bookworm

      Affected

      dsa · phpldapadmin · debian · bookworm; dsa · phpldapadmin · debian · 12

    • 1.2.6.3-0.3+deb12u1 · all · bookworm

      Affected

      dsa · phpldapadmin · debian · bookworm; dsa · phpldapadmin · debian · 12

    • 1.2.6.7-3~bpo12+1 · all · bookworm-backports

      Affected

      dsa · phpldapadmin · debian · bookworm; dsa · phpldapadmin · debian · 12

    • 1.2.6.7-3~bpo12+1 · all · bookworm-backports

      Affected

      dsa · phpldapadmin · debian · bookworm; dsa · phpldapadmin · debian · 12

[Debian 13 (Trixie)]

  • [phpldapadmin]Fixed
    Details (2)

    • 1.2.6.7-4 · all · trixie

      Fixed · Fixed: 1.2.6.7-4

      dsa · phpldapadmin · debian · 13

    • 1.2.6.7-4 · all · trixie

      Fixed · Fixed: 1.2.6.7-4

      dsa · phpldapadmin · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]