CVE-2018-12421: Ltb-Project LDAP Tool Box Self Service Password

Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days.

LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.

Affected products

• Ltb-Project LDAP Tool Box Self Service Password: before 1.3 (fixed in 1.3)

Published 2018-06-14. Last modified 2026-06-17.