CVE-2023-4757: Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries
First published: Tue Jan 16 2024(Updated: )
The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Miniorange Staff / Employee Business Directory For Active Directory | <1.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-4757?
CVE-2023-4757 is considered a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2023-4757?
To fix CVE-2023-4757, update the Staff / Employee Business Directory for Active Directory plugin to version 1.2.3 or later.
What is the impact of CVE-2023-4757?
CVE-2023-4757 allows attackers to inject malicious JavaScript into web pages, potentially compromising user data and security.
Who is affected by CVE-2023-4757?
Anyone using the Staff / Employee Business Directory for Active Directory plugin versions prior to 1.2.3 is vulnerable to CVE-2023-4757.
What type of vulnerability is CVE-2023-4757?
CVE-2023-4757 is classified as a cross-site scripting (XSS) vulnerability.
- agent/weakness
- agent/author
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/softwarecombine
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/miniorange
- canonical/miniorange staff / employee business directory for active directory