PT-2023-3437 · WordPress · Active Directory Integration / Ldap Integration

Andreas Krüger + 1 · Publicado 2023-06-28 · Atualizado 2023-07-07 · CVE-2023-3447

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Active Directory Integration / LDAP Integration plugin for WordPress versions up to, and including, 4.1.5

Description The issue is related to insufficient escaping on the supplied username value, which makes it possible for unauthenticated attackers to extract potentially sensitive information from the LDAP directory. This is due to the plugin's failure to properly neutralize special elements in the LDAP query when processing the username parameter.

Recommendations For versions up to, and including, 4.1.5, update to a version that properly escapes the username value to prevent LDAP injection attacks. As a temporary workaround, consider restricting access to the LDAP directory or implementing additional security measures to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-90

Identificadores relacionados

BDU:2023-03619

CVE-2023-3447

Produtos afetados

Active Directory Integration / Ldap Integration

Referências · 11

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail= · Correção
• https://vuldb.com/ru/?id.232644 · Nota
• https://t.me/cvenotify/53300 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/cd7553e8-e43d-4740-b2ee-e3d8dc351e53?source=cve · Nota
• https://t.me/cvenotify/53285 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3447 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03619 · Nota de Segurança
• https://t.me/cibsecurity/65708 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ldap-login-for-intranet-sites/active-directory-integration-ldap-integration-415-unauthenticated-ldap-injection · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3447 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail= · Nota