{"id":"CVE-2020-24660","aliases":["DEBIAN-CVE-2020-24660","DLA-2367-1","DSA-4762-1","EUVD-2020-1371","GHSA-x44x-r84w-8v67","UBUNTU-CVE-2020-24660"],"status":"published","title":"Lack of URL normalization may lead to authorization bypass when URL access rules are used","description":"An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the \"Lemonldap::NG handler for Node.js\" package.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02463,"percentile":0.84581,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-425"],"published":"2020-09-07T00:00:00Z","modified":"2026-11-04T02:45:40Z","fixes":[{"ecosystem":"npm","package":"lemonldap-ng-handler","fixed_in":["0.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"lemonldap-ng","fixed_in":["2.0.9+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lemonldap-ng","fixed_in":["2.0.9+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lemonldap-ng","fixed_in":["2.0.9+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"lemonldap-ng","fixed_in":["1.9.7-3+deb9u4"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"lemonldap-ng","fixed_in":["2.0.2+ds-7+deb10u5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"lemonldap-ng-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-3+deb9u4"}]}],"versions":["1.9.7-3","1.9.7-3+deb9u1","1.9.7-3+deb9u2"]},{"source":"osv","ecosystem":"Debian:10","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+ds-7+deb10u5"}]}],"versions":["2.0.2+ds-7+deb10u1","2.0.2+ds-7+deb10u2","2.0.2+ds-7+deb10u3","2.0.2+ds-7+deb10u4"]},{"source":"osv","ecosystem":"npm","package":"lemonldap-ng-handler","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-1","1.4.6-1","1.4.6-2","1.4.6-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.10-1","1.9.13-2","1.9.14-1","1.9.15-1","1.9.16-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lemonldap-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5+ds-2","2.0.6+ds-2","2.0.7+ds-2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"lemonldap-ng","product":"lemonldap\\"}],"references":[{"url":"https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://www.debian.org/security/2020/dsa-4762","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/commit/136aa83ed431462fa42ce17b7f9b24e056de06be","tags":["web"]},{"url":"https://www.npmjs.com/package/lemonldap-ng-handler","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24660","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-NODELEMONLDAPNGHANDLER-655999","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x44x-r84w-8v67"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-24660","tags":["advisory"]},{"url":"https://github.com/LemonLDAPNG/node-lemonldap-ng-handler","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-24660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24660","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-24660","description":"An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the \"Lemonldap::NG handler for Node.js\" package.","status":"published","published":"2020-09-14T12:51:48Z","modified":"2024-08-04T15:19:09.076Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-1371","description":"An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the \"Lemonldap::NG handler for Node.js\" package.","status":"published","published":"2020-09-14T12:51:48Z","modified":"2024-08-04T15:19:09Z","updated_at":"2026-11-03T03:07:19.775117Z"}],"ghsa":[{"id":"GHSA-x44x-r84w-8v67","title":"Lack of URL normalization may lead to authorization bypass when URL access rules are used","description":"### Impact\nWhen access rules are used inside a protected host, some URL encodings may bypass filtering system.\n\n### Patches\nVersion 0.5.2 includes a patch that fixes the vulnerability\n\n### Workarounds\nNo way for users to fix or remediate the vulnerability without upgrading\n\n### References\nhttps://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repository](https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/issues) or [LemonLDAP::NG GitLab](https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues)\n* Email us at [lemonldap-ng-users@ow2.org](mailto:lemonldap-ng-users@ow2.org)","status":"published","published":"2020-09-09T18:45:55Z","modified":"2023-01-09T05:03:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:36:07.581563Z"}],"nvd":[{"id":"CVE-2020-24660","description":"An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the \"Lemonldap::NG handler for Node.js\" package.","status":"published","published":"2020-09-14T13:15:10.03Z","modified":"2026-06-17T03:05:56.157Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"CVE-2020-24660","description":"An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the \"Lemonldap::NG handler for Node.js\" package.","status":"published","published":"2020-09-14T13:15:10.03Z","modified":"2026-11-09T10:45:10.434113687Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2020-24660","description":"An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the \"Lemonldap::NG handler for Node.js\" package.","status":"published","published":"2020-09-14T13:15:10.03Z","modified":"2026-10-26T12:00:40.274434798Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"GHSA-x44x-r84w-8v67","title":"Lack of URL normalization may lead to authorization bypass when URL access rules are used","description":"### Impact\nWhen access rules are used inside a protected host, some URL encodings may bypass filtering system.\n\n### Patches\nVersion 0.5.2 includes a patch that fixes the vulnerability\n\n### Workarounds\nNo way for users to fix or remediate the vulnerability without upgrading\n\n### References\nhttps://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repository](https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/issues) or [LemonLDAP::NG GitLab](https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues)\n* Email us at [lemonldap-ng-users@ow2.org](mailto:lemonldap-ng-users@ow2.org)","status":"published","published":"2020-09-09T18:45:55Z","modified":"2026-07-08T06:00:20.009277666Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"UBUNTU-CVE-2020-24660","description":"An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the \"Lemonldap::NG handler for Node.js\" package.","status":"published","published":"2020-09-14T13:15:00Z","modified":"2025-10-24T04:48:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-2367-1","title":"lemonldap-ng - security update","status":"published","published":"2020-09-07T00:00:00Z","modified":"2026-03-09T01:22:25.792152Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4762-1","title":"lemonldap-ng - security update","status":"published","published":"2020-09-07T00:00:00Z","modified":"2026-03-09T02:10:21.766178Z","updated_at":"2026-11-02T15:46:17.19998Z"}]}}