Read the docs
TI-2020-12031 Aliases CVE-2020-15259

CSRF in Auth0 ad-ldap-connector

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on, you are not affected. The issue is fixed in version 5.0.13.

Why it matters now

EPSS 0.00972 62nd percentileScored 2026-11-07
Fix Fixed ad-ldap-connector (auth0): 0.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0ad-ldap-connectorbefore 0.0.10.0.1Patch availableCNA
  • ad-ldap-connector Vendorauth0 Affected before 0.0.1 Fixed in 0.0.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:ad\/ldap_connector:*:*:*:*:*:node.js:*:*before 5.0.13Vulnerableauth0
  • cpe:2.3:a:auth0:ad\/ldap_connector:*:*:*:*:*:node.js:*:* Versions before 5.0.13 Vulnerable ·auth0

Remediation

  • Fix · CNA ad-ldap-connector (auth0) Fixed in 0.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15259

References

Patch 1

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences