Every CVE Search/ Get API key

CVE-2020-24660

Lack of URL normalization may lead to authorization bypass when URL access rules are used

9.8 CriticalFix available

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.46%Up 1.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

Record
CVE-2020-24660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-425
Updated
2026-11-02
CVE List No score

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

Record
CVE-2020-24660
Updated
2026-11-02
EUVDEUVD-2020-1371 No score

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

Record
EUVD-2020-1371
Updated
2026-11-03
GitHub AdvisoriesGHSA-x44x-r84w-8v67 6.5

Lack of URL normalization may lead to authorization bypass when URL access rules are used

Impact

When access rules are used inside a protected host, some URL encodings may bypass filtering system.

Patches

Version 0.5.2 includes a patch that fixes the vulnerability

Workarounds

No way for users to fix or remediate the vulnerability without upgrading

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290

For more information

If you have any questions or comments about this advisory:

Record
GHSA-x44x-r84w-8v67
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-287
Updated
2026-11-02
OSV 9.8

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

Record
CVE-2020-24660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-07
OSVDEBIAN-CVE-2020-24660 9.8

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

Record
DEBIAN-CVE-2020-24660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-x44x-r84w-8v67 6.5

Lack of URL normalization may lead to authorization bypass when URL access rules are used

Impact

When access rules are used inside a protected host, some URL encodings may bypass filtering system.

Patches

Version 0.5.2 includes a patch that fixes the vulnerability

Workarounds

No way for users to fix or remediate the vulnerability without upgrading

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290

For more information

If you have any questions or comments about this advisory:

Record
GHSA-x44x-r84w-8v67
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-287
Updated
2026-11-02
OSVUBUNTU-CVE-2020-24660 9.8

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

Record
UBUNTU-CVE-2020-24660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lemonldap-ng-handler
npm
 before 0.5.2
0.5.2
lemonldap-ng
Debian:12
 before 2.0.9+ds-1
2.0.9+ds-1
lemonldap-ng
Debian:13
 before 2.0.9+ds-1
2.0.9+ds-1
lemonldap-ng
Debian:14
 before 2.0.9+ds-1
2.0.9+ds-1
lemonldap-ng
Debian:9
 before 1.9.7-3+deb9u4, plus listed versions
1.9.7-31.9.7-3+deb9u11.9.7-3+deb9u2
1.9.7-3+deb9u4
lemonldap-ng
Debian:10
 before 2.0.2+ds-7+deb10u5, plus listed versions
2.0.2+ds-7+deb10u12.0.2+ds-7+deb10u22.0.2+ds-7+deb10u32.0.2+ds-7+deb10u4
2.0.2+ds-7+deb10u5
lemonldap-ng
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.3.3-11.4.6-11.4.6-21.4.6-3
 None known
lemonldap-ng
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.9.10-11.9.13-21.9.14-11.9.15-11.9.16-2
 None known
lemonldap-ng
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.0.5+ds-22.0.6+ds-22.0.7+ds-2
 None known

History

History
RecordedChangedSources
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-24660 is a critical vulnerability (CVSS 9.8) in Debian Linux, published September 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. Fixed in lemonldap-ng-handler 0.5.2.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open