[Git][security-tracker-team/security-tracker][master] Update status for CVE-2024-9102/phpldapadmin

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a3febde4 by Salvatore Bonaccorso at 2025-04-11T20:42:25+02:00
Update status for CVE-2024-9102/phpldapadmin

Thanks: William Desportes

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -36704,10 +36704,12 @@ CVE-2023-7005 (A specially crafted message can be sent to the TTLock App that do
 CVE-2023-4617 (Incorrect authorization vulnerability in HTTP POST method in Govee Hom ...)
 	NOT-FOR-US: Govee Home application on Android and iOS
 CVE-2024-9102 (phpLDAPadmin since at least version 1.2.0 through the latest version 1 ...)
-	- phpldapadmin <unfixed> (bug #1090914)
-	[bookworm] - phpldapadmin <postponed> (Minor issue, revisit when fixed upstream)
-	[bullseye] - phpldapadmin <postponed> (Minor issue, revisit when fixed upstream)
+	- phpldapadmin <unfixed> (bug #1090914; unimportant)
 	NOTE: https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/
+	NOTE: Not considered a security vulnerability by upstream. It is not the intention
+	NOTE: of phpldapadmin to control what data administrators put in their LDAP database,
+	NOTE: nor to filter it on export. Cf.:
+	NOTE: https://github.com/leenooks/phpLDAPadmin/issues/274#issuecomment-2586859072
 CVE-2024-9101 (A reflected cross-site scripting (XSS) vulnerability in the 'Entry Cho ...)
 	- phpldapadmin 1.2.6.7-4 (bug #1090914)
 	[bookworm] - phpldapadmin <postponed> (Minor issue, revisit when fixed upstream)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a3febde405d2a20b37d5ac1add32768793503fc7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a3febde405d2a20b37d5ac1add32768793503fc7
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250411/19e7efcd/attachment.htm>