6.5

CVE-2023-4506

Exploit

Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback

Active Directory Integration / LDAP Integration <= 4.1.9 - Sensitive Information Exposure

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.
Mögliche Gegenmaßnahme
Active Directory Integration / LDAP Integration: Update to version 4.2, or a newer patched version
Active Directory Integration / LDAP Integration: Update to version 4.1.10, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Active Directory Integration / LDAP Integration
Version *-4.1.10
SystemWordPress Plugin
≫
Produkt Active Directory Integration / LDAP Integration
Version *-4.1.9
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Miniorange ≫ Active Directory Integration / Ldap Integration SwPlatformwordpress Version <= 4.1.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.587
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 1.2 5.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
security@wordfence.com 2.2 0.7 1.4
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.