CVE-2023-0812 Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure

What is CVE-2023-0812?

CVE-2023-0812 is a high-severity missing authorization vulnerability in Unknown Active Directory Integration / LDAP Integration, published on 15 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.

Which versions are affected by CVE-2023-0812?

It affects 1 product.

Products include Miniorange Active Directory Integration \/ Ldap Integration.

How do I fix CVE-2023-0812?

No fix has been published for CVE-2023-0812 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-0812 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0812 exists.

Other vulnerabilities in Unknown Active Directory Integration / LDAP Integration

• CVE-2023-3447 Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection High 7.6
• CVE-2023-5003 Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure High 7.5
• CVE-2023-2484 Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection High 7.2
• CVE-2023-2599 Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection Low 3.1
• CVE-2023-4506 Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback Low 2.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7rw4-5qwp-72w6.