CVE-2020-23148

Name of the Vulnerable Software and Affected Versions rConfig version 3.9.5

Description The issue arises from the lack of sanitization of the userLogin parameter in the ldap/login.php file of the rConfig utility for managing network device configurations. This allows attackers to perform a LDAP injection, potentially obtaining sensitive information via a crafted POST request to the "ldap/login.php" endpoint, specifically exploiting the userLogin parameter.

Recommendations For rConfig version 3.9.5, consider disabling the ldap/login.php endpoint or restricting access to it until a patch is available to sanitize the userLogin parameter and prevent LDAP injection attacks.