CVE-2023-2484highCWE-89

CVE-2023-2484: high-severity vulnerability in cyberlord92 Active Directory Integration /…

Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection

Published · Updated

Follow this CVE+ Monitor Active Directory Integration / LDAP Integration

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.8%
The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
cyberlord92 · Active Directory Integration / LDAP Integration
Related CVEs — cyberlord92 Active Directory Integration /…

In the same product, most dangerous first.

CVE-2023-4506LOWActive Directory Integration / LDAP Integration <= 4.1.10 - LDAP PassbackEPSS 0.9%CVE-2023-3447HIGHActive Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP InjectionEPSS 0.5%CVE-2023-2599LOWActive Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL InjectionEPSS 0.4%