VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jul 18, 2022· Updated Jun 17, 2026

CVE-2021-40874

CVE-2021-40874

Description

An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos authentication method combined with another method with the Combination authentication plug-in, any password will be recognized as valid for an existing user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Lemonldap Ng/Lemonldap Ng2 versions
    cpe:2.3:a:lemonldap-ng:lemonldap\:\:ng:2.0.13:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:lemonldap-ng:lemonldap\:\:ng:2.0.13:*:*:*:*:*:*:*
    • (no CPE)range: =2.0.13
  • Debian/linux
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • LemonLDAP::NG/LemonLDAP::NGdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.