CVE-2023-23749

7.5 highEPSS 0.6%

High (7.5) in miniorange ldap integration with active directory and openldap. EPSS 0.6% chance of exploitation in the next 30 days.

The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2023-01-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

miniorange:ldap_integration_with_active_directory_and_openldap

References

https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/
https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/

Check your stack JSON