CVE-2023-44469: Lemonldap-NG Lemonldap::ng

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.

Affected products

• Lemonldap-NG Lemonldap::ng: before 2.17.1 (fixed in 2.17.1)

Published 2023-09-29. Last modified 2026-06-17.