In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 17 Sep 2025 03:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server. | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-09-17T03:16:23.038Z
Reserved: 2025-09-17T00:00:00.000Z
Link: CVE-2025-59518
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-09-17T04:16:12.527
Modified: 2025-09-17T04:16:12.527
Link: CVE-2025-59518
Redhat
No data.
OpenCVE Enrichment
No data.