PatchTheCVEphpldapadmin vulnerabilities and fixes
Recent CVEs affecting phpldapadmin, with upgrade or downgrade steps. 4 tracked.
phpldapadmin has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2020-12-11. Highest priority: CVE-2018-12689 (score 64/100).
- CVE-2020-35132 MEDIUM 5.4 UPGRADE MITIGATE An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values th
- CVE-2018-12689 CRITICAL 9.8 DOWNGRADE phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request
- CVE-2017-11107 MEDIUM 6.1 UPGRADE MITIGATE phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form, element, rdn, or container parame
- CVE-2011-4082 HIGH 7.5 UPGRADE MITIGATE A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the
FAQ
How do I fix phpldapadmin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is phpldapadmin being exploited right now?
None of the tracked phpldapadmin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which phpldapadmin CVE should I patch first?
CVE-2018-12689 currently ranks highest (64/100): phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request.