Vulnerability · Published Jan 17, 2023 · Assigned by Joomla
CVE-2023-23749Extension - miniorange - LDAP Integration - LDAP Injection (username)
High 7.5
In plain English
A high-severity injection in LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login from miniorange. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 52.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| miniorange | LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login | 5.0.2 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N