CVE-2005-2654

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-08-30 · updated 2026-06-16

Description

phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to login.php with the anonymous_bind parameter set.

Affected products

Phpldapadmin Project Phpldapadmin: before 0.9.6c — fixed in 0.9.6c

How to fix

Upgrade to a fixed version: Phpldapadmin Project Phpldapadmin 0.9.6c. Check the vendor advisory for mitigations.

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=322423
http://www.debian.org/security/2005/dsa-790
http://www.gentoo.org/security/en/glsa/glsa-200509-04.xml
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=322423
http://www.debian.org/security/2005/dsa-790
http://www.gentoo.org/security/en/glsa/glsa-200509-04.xml

Get alerted when CVE-2005-2654 or the next vulnerability affects your stack