CVE-2020-35132: 
Linux Debian vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in phpLDAPadmin versions before 1.2.6.2, identified as CVE-2020-35132. The vulnerability allows users to store malicious values that can be executed by other users at a later time via the get_request function in lib/function.php (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue specifically involves the get_request function in lib/function.php, where user input was not properly sanitized before being stored and displayed to other users (NVD).

When exploited, this vulnerability allows attackers to store malicious values that can execute when other users, including administrators, attempt to modify or view the affected fields. This creates a potential for stored XSS attacks where malicious scripts can be triggered when other users interact with the compromised data (Github Issue).

The vulnerability requires an authenticated user to store the malicious payload, which can then be triggered when other users, particularly administrators, attempt to modify the affected fields. A proof of concept has been documented showing how an attacker can set a field to an XSS payload that triggers during the confirmation screen for field modifications (Github Issue).

The vulnerability has been fixed in phpLDAPadmin version 1.2.6.2. The fix includes improvements to the XSS prevention mechanism in the get_request function and setting preventXSS to true by default (Github Commit). Users are advised to upgrade to version 1.2.6.2 or later to address this security issue (Fedora Update).