title: Missing Authorization Checks in LiderAhenk
description: On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
defaultStatus: unaffected
product: Lider
vendor: TUBITAK
versions:
lessThan: 2.1.16, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: https://github.com/mdisec/pardus-liderahenk-0day-RCE
solutions: Lider component should be updated to 2.1.16.