Vulnerability · Published Oct 16, 2023 · Assigned by WPScan
CVE-2023-5003Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure
High 7.5
In plain English
A high-severity security flaw in Active Directory Integration / LDAP Integration from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 26.6% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)26.6%top 2.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Active Directory Integration / LDAP Integration | 0 – before 4.1.10 |
References
- https://wpscan.com/vulnerability/91f4e500-71f3-4ef6-9cc7-24a7c12a5748 exploit, vdb-entry, technical-description