CVE-2023-23749
HIGHLDAP Integration with Active Directory and OpenLDAP - LDAP Injection via Username Parameter
Title source: llmDescription
The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.
References (1)
Core 1
Core References
Third Party Advisory vendor-advisory
https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/
Scores
CVSS v3
7.5
EPSS
0.0056
EPSS Percentile
42.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-74
Status
published
Products (1)
miniorange/ldap_integration_with_active_directory_and_openldap
5.0.2
Published
Jan 17, 2023
Tracked Since
Feb 18, 2026