CVE-2022-2987 - Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth Bypass

Back Back to CVE browser

HIGH

Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth Bypass

Published Sep 26, 2022

7.5

HIGH

CVSS 3.1

EPSS 0.52%

Description

The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication

Affected products

Vendor n/a Product Ldap WP Login / Active Directory Integration Default
n/a
- Version
  3.0.2
  Status
  affected
  Constraints
  <3.0.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Ldap WP Login / Active Directory Integration

n/a

Version	Status	Constraints
3.0.2	affected	<3.0.2

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35207
Advisory
https://wpscan.com/vulnerability/0d9638b9-bf8a-474f-992d-2618884d3f67
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35207		Advisory
https://wpscan.com/vulnerability/0d9638b9-bf8a-474f-992d-2618884d3f67		x_refsource_MISCExploitThird Party Advisory