PT-2020-14320 · Unknown · Ad-Ldap-Connector

Gkwang · Published 2020-11-06 · Updated 2020-11-18 · CVE-2020-15259

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ad-ldap-connector versions prior to 5.0.13

Description The issue concerns a lack of CSRF protection in the admin panel, which can be exploited to achieve remote code execution or result in confidential data loss. This can occur when a user visits a malicious page with a CSRF payload on the same machine that has access to the admin console via a browser.

Recommendations For versions prior to 5.0.13, update to version 5.0.13 to resolve the issue. As a temporary workaround, consider disabling the admin console until the update is applied. Additionally, avoid visiting public URLs on the machine where the admin console is installed to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-15259

GHSA-VX5Q-CP9V-427V

Affected Products

Ad-Ldap-Connector

References · 4

• https://github.com/auth0/ad-ldap-connector/commit/8b793631ec5ecacf63ff3ece23231a9e138ae911 · Patch
• https://osv.dev/vulnerability/CVE-2020-15259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15259 · Security Note
• https://github.com/auth0/ad-ldap-connector/security/advisories/GHSA-vx5q-cp9v-427v · Note