CVE-2023-4506CWE-306

Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback

Low · published September 26, 2023

CVSS v3.1
2.2
EPSS
1%
Percentile
59.6
In the wild
Unconfirmed
What it is

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00911 · 59.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2023-09-26T01:51Z
EPSS history
Timeline
  • 26 SEP 01:51Z
    Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback
    cvelistv5