LiveActive security incident?Get immediate response
CVE Record

CVE-2019-19791: In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not pro...

In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG setup options are used). For example, an attacker can insert index.fcgi/index.fcgi into a URL to bypass a Require directive.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This flaw can let an unauthenticated internet user bypass intended Apache access controls protecting LemonLDAP::NG SOAP/REST endpoints. If the affected setup is exposed, it may undermine the identity and access-management layer itself, creating a high business-impact path to data exposure, unauthorized changes, or service disruption.

Executive priority

Prioritize remediation for any internet-facing LemonLDAP::NG deployment because this affects access-control enforcement around identity infrastructure. Systems below 2.0.7 should be reviewed immediately, especially where SOAP/REST endpoints are exposed.

Technical view

LemonLDAP::NG before 2.0.7 had a default Apache HTTP Server configuration weakness. Under some setup options, URL path manipulation could bypass a Require directive intended to restrict SOAP/REST endpoints. The CVSS 3.1 score is 9.8 because exploitation is network reachable, low complexity, unauthenticated, and high impact.

Likely exposure

Exposure is most likely where LemonLDAP::NG versions before 2.0.7 are deployed behind the default Apache configuration and SOAP/REST endpoints are reachable. The source bundle does not provide precise CPEs or a complete affected-version matrix beyond before 2.0.7.

Exploitation context

The CVSS vector indicates unauthenticated remote exploitation with low complexity and no user interaction. The provided sources do not show CISA KEV listing or confirmed active exploitation. Treat internet-facing identity infrastructure as urgent even without public exploitation evidence.

Researcher notes

Key unknowns are the exact affected setup options and whether local Apache customizations already prevent exposure. The source bundle identifies the vulnerable condition and fixed release boundary, but does not provide a complete product matrix, exploit-in-the-wild evidence, or detailed hardening steps.

Mitigation direction

  • Upgrade LemonLDAP::NG to 2.0.7 or later where applicable.
  • Review OW2 LemonLDAP::NG guidance for exact fixed configuration details.
  • Audit Apache rules protecting SOAP and REST endpoints.
  • Restrict external access to management or service endpoints where possible.
  • Monitor logs for unusual access to protected LemonLDAP::NG endpoints.

Validation and detection

  • Inventory all LemonLDAP::NG deployments and record versions.
  • Identify deployments using Apache HTTP Server front-end configuration.
  • Confirm whether SOAP or REST endpoints are reachable externally.
  • Review Apache Require rules for protected LemonLDAP::NG paths.
  • Perform authorized, non-destructive access-control testing after remediation.
  • Check historical logs for suspicious protected-endpoint access.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-19791 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2019-19791Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.