What is CVE-2024-9101?

CVE-2024-9101 is a vulnerability in Phpldapadmin, classified under Cross-site Scripting. Published 2024-12-19.

Is CVE-2024-9101 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Phpldapadmin

CVE-2024-9101

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.005 (38.5th percentile) — read the EPSS interpretation.

Affected products

Phpldapadmin — versions 1.2.1, 1.2.6.7

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

vulnerability@ncsc.ch (third-party-advisory)
vulnerability@ncsc.ch
vulnerability@ncsc.ch
vulnerability@ncsc.ch

Frequently asked questions

What is CVE-2024-9101?: CVE-2024-9101 is a vulnerability in Phpldapadmin, classified under Cross-site Scripting. Published 2024-12-19.
Is CVE-2024-9101 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.