CVE-2023-23749: Extension - miniorange - LDAP Integration - LDAP Injection (username)
First published: Tue Jan 17 2023(Updated: )
The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.
Credit: security@joomla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MiniOrange Active Directory Integration / LDAP Integration | =5.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-23749.
What is the title of the vulnerability?
The title of the vulnerability is 'The LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension is vulnerable to LDAP Injection'.
What is the severity of CVE-2023-23749?
The severity of CVE-2023-23749 is high with a CVSS score of 7.5.
How does CVE-2023-23749 affect the LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension?
CVE-2023-23749 affects the LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension by allowing LDAP Injection due to improper sanitization of the 'username' POST parameter.
Is there a fix available for CVE-2023-23749?
Yes, a fix for CVE-2023-23749 is available. It is recommended to update to the latest version of the LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login extension.
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/miniorange
- canonical/miniorange active directory integration / ldap integration
- version/miniorange active directory integration / ldap integration/5.0.2