CVE-2023-23749: Extension - miniorange - LDAP Integration - LDAP Injection (username)
The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-23749.
What is the title of the vulnerability?
The title of the vulnerability is 'The LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension is vulnerable to LDAP Injection'.
What is the severity of CVE-2023-23749?
The severity of CVE-2023-23749 is high with a CVSS score of 7.5.
How does CVE-2023-23749 affect the LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension?
CVE-2023-23749 affects the LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension by allowing LDAP Injection due to improper sanitization of the 'username' POST parameter.
Is there a fix available for CVE-2023-23749?
Yes, a fix for CVE-2023-23749 is available. It is recommended to update to the latest version of the LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension.