CVE-2023-2599lowCWE-352

CVE-2023-2599: low-severity vulnerability in cyberlord92 Active Directory Integration /…

Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection

Published · Updated

Follow this CVE+ Monitor Active Directory Integration / LDAP Integration

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.1epss 0.4%
The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to missing nonce verification on the get_users function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to cause resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
cyberlord92 · Active Directory Integration / LDAP Integration
Related CVEs — cyberlord92 Active Directory Integration /…

In the same product, most dangerous first.

CVE-2023-4506LOWActive Directory Integration / LDAP Integration <= 4.1.10 - LDAP PassbackEPSS 0.9%CVE-2023-2484HIGHActive Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL InjectionEPSS 0.8%CVE-2023-3447HIGHActive Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP InjectionEPSS 0.5%