Vulnerabilities

TI-2023-04605 CVE-2023-5003 · GHSA-2vvx-5g27-9gvj

Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure

HIGH 72

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.26633 Published 2023-10-16 Fixed in 4.1.10

TI-2023-04159 CVE-2023-4506 · GHSA-jpx4-gr7j-qv9p

Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback

LOW 31

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00911 Published 2023-09-26 No fix listed CWE-306

TI-2023-03221 CVE-2023-3447 · GHSA-wxg4-73q7-87rm

Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection

MEDIUM 40

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00528 Published 2023-06-29 No fix listed CWE-90

TI-2023-02429 CVE-2023-2599 · GHSA-267v-vcrf-m92x

Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection

LOW 29

The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to mi…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00424 Published 2023-06-09 No fix listed CWE-352

TI-2023-02332 CVE-2023-2484 · GHSA-c6h8-w2p9-jcrc

Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection

LOW 35

The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user suppli…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00847 Published 2023-06-09 No fix listed CWE-89

TI-2023-00770 CVE-2023-0812 · GHSA-7rw4-5qwp-72w6

Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure

HIGH 66

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00819 Published 2023-05-15 Fixed in 4.1.1