A critical cross-site scripting vulnerability in LemonLDAP::NG allows unauthenticated attackers to execute malicious scripts, posing a significant risk to user session integrity.

This flaw is a cross-site scripting (XSS) vulnerability (CWE-79) residing in the portal component. Unauthenticated attackers can exploit this by injecting malicious scripts through the tab parameter during the Choice authentication process.

The ability for unauthenticated remote attackers to inject scripts into the login page presents a severe risk of session hijacking, credential theft, and unauthorized redirection of users. Given the CVSS score of 7.2, this vulnerability is classified as High severity, as it facilitates the compromise of user-sensitive data and undermines the trust in the authentication gateway.

Immediate Action: Upgrade LemonLDAP::NG to version 2.16.5, 2.21.0, or the latest available stable release to incorporate the necessary security patches.

Proactive Monitoring: Review web server and application logs for suspicious input patterns in the tab parameter or unexpected script tags appearing within the portal login interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block malicious XSS payloads targeting the login portal until the application can be updated.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing LemonLDAP::NG as an authentication provider must prioritize this update to prevent potential account takeover and unauthorized access. Due to the ease of exploitation, applying the vendor-provided patches is the only effective way to remediate this vulnerability and secure the authentication infrastructure.