CVE-2023-41580: High severity phpipam vulnerability

Q: What is the severity of CVE-2023-41580?

The severity of CVE-2023-41580 is high with a CVSS score of 7.5 out of 10.

Q: How does CVE-2023-41580 affect Phpipam?

CVE-2023-41580 affects Phpipam versions up to and excluding v1.5.2.

Q: What is the vulnerability in Phpipam that is associated with CVE-2023-41580?

The vulnerability in Phpipam associated with CVE-2023-41580 is an LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php.

Q: What can attackers do with CVE-2023-41580?

Attackers can enumerate arbitrary fields in the LDAP server and access sensitive data by exploiting CVE-2023-41580 through a crafted POST request.

Q: How can I fix CVE-2023-41580 in Phpipam?

To fix CVE-2023-41580 in Phpipam, update to version 1.5.2 or above.

Published Oct 2, 2023

Updated

Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.

Affected Software

1 affected component

Phpipam Phpipam<1.5.2

Remediation

Patch Available

https://github.com/phpipam/phpipam/commit/c451085476074943eb4056941005c0b61db566c5

Event History

Oct 2, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2023-41580?

The severity of CVE-2023-41580 is high with a CVSS score of 7.5 out of 10.

How does CVE-2023-41580 affect Phpipam?

CVE-2023-41580 affects Phpipam versions up to and excluding v1.5.2.

What is the vulnerability in Phpipam that is associated with CVE-2023-41580?