CVE-2019-13031

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-28 · updated 2026-06-17
Weakness: CWE-611

Description

LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule.

Affected products

Debian Linux: 8.0
lemonldap-ng Lemonldap::: before 1.9.20 — fixed in 1.9.20

How to fix

Upgrade to a fixed version: lemonldap-ng Lemonldap:: 1.9.20. Check the vendor advisory for mitigations.

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1820
https://lists.debian.org/debian-lts-announce/2019/07/msg00003.html
https://www.calypt.com/blog/index.php/cve-2019-13031-xxe-on-lemonldapng-2-0-5/
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1820
https://lists.debian.org/debian-lts-announce/2019/07/msg00003.html
https://www.calypt.com/blog/index.php/cve-2019-13031-xxe-on-lemonldapng-2-0-5/

Get alerted when CVE-2019-13031 or the next vulnerability affects your stack