CVE-2018-12421
LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind …
Published: 2018-06-14 · CVSS: Unscored
LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7