CVE-2018-12421

LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.
Configurations

Configuration 1 (hide)

cpe:2.3:a:ltb-project:ldap_tool_box_self_service_password:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-06-14 19:29

Updated : 2024-02-28 16:25


NVD link : CVE-2018-12421

Mitre link : CVE-2018-12421

CVE.ORG link : CVE-2018-12421


JSON object : View

Products Affected

ltb-project

  • ldap_tool_box_self_service_password
CWE
CWE-640

Weak Password Recovery Mechanism for Forgotten Password