LdapCherry Cross-site Scripting vulnerbaility

中危 6.1CVE-2019-25095 · GHSA-vq8w-x8v7-f88m · PYSEC-2023-19 · Published 05/01/2023 · updated 17/06/2026

要点

CVE-2019-25095 是影响 ldapcherry, ldapcherry (ldapcherry project) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.59%，高于 48.4% 的漏洞。
修复：升级到 1.0.0 或更高版本。

Package	Affected versions	Patched versions
ldapcherry PyPI	`< 1.0.0`	`1.0.0`
ldapcherry ldapcherry_project	`< 1.0.0`	`1.0.0`

Description

A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 6f98076281e9452fdb1adcd1bcbb70a6f968ade9. It is recommended to upgrade the affected component. VDB-217434 is the identifier assigned to this vulnerability.

NVD description

A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 6f98076281e9452fdb1adcd1bcbb70a6f968ade9. It is recommended to upgrade the affected component. VDB-217434 is the identifier assigned to this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2019-25095 · ADVISORY
kakwa/ldapcherry#16 · WEB
kakwa/ldapcherry commit 6f98076 · WEB
kakwa/ldapcherry · PACKAGE
kakwa/ldapcherry release 1.0.0 · WEB
pypa/advisory-database · WEB
vuldb.com · WEB
vuldb.com · WEB
GitHub Advisory GHSA-vq8w-x8v7-f88m · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ldapcherry

PyPI

< 1.0.0

1.0.0

ldapcherry

ldapcherry_project

< 1.0.0

1.0.0

Description

NVD description

A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 6f98076281e9452fdb1adcd1bcbb70a6f968ade9. It is recommended to upgrade the affected component. VDB-217434 is the identifier assigned to this vulnerability.