CVE-2020-24660

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

• CWE-425

• https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2Third Party Advisory
• https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67Third Party Advisory
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290Exploit, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4762Third Party Advisory
• https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2Third Party Advisory
• https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67Third Party Advisory
• https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290Exploit, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4762Third Party Advisory

Published

Sep 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24653secure-store in Expo through 2.16.1 on iOS provides the inse…9.8
• CVE-2020-24654In KDE Ark before 20.08.1, a crafted TAR archive with symlin…3.3
• CVE-2020-24655A race condition in the Twilio Authy 2-Factor Authentication…5.1
• CVE-2020-24656Maltego before 4.2.12 allows XXE attacks.6.5
• CVE-2020-24658Arm Compiler 5 through 5.06u6 has an error in a stack protec…7.8
• CVE-2020-24659An issue was discovered in GnuTLS before 3.6.15. A server ca…7.5
• CVE-2020-24661GNOME Geary before 3.36.3 mishandles pinned TLS certificate …5.9
• CVE-2020-24662SmartStream Transaction Lifecycle Management (TLM) Reconcili…5.4
• CVE-2020-24663Trace Financial CRESTBridge <6.3.0.02 contains a stored XSS …5.4
• CVE-2020-24664The dashboard Editor in Hitachi Vantara Pentaho through 7.x …5.4
• CVE-2020-24665The Dashboard Editor in Hitachi Vantara Pentaho through 7.x …6.5
• CVE-2020-24666The Analysis Report in Hitachi Vantara Pentaho through 7.x -…5.4