CVE-2023-5003
Miniorange Active Directory Integration \/ Ldap Integration ≤ 4.1.10
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2023-5003 is a high-severity an unspecified weakness vulnerability in Miniorange Active Directory Integration \/ Ldap Integration. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability CVE-2023-5003 affects the Active Directory Integration / LDAP Integration WordPress plugin before version 4.1.10. When an administrator initiates an export of LDAP logs, the plugin writes sensitive information to a buffer file that is never subsequently deleted and remains reachable by anyone who knows its direct URL.
An unauthenticated remote attacker can exploit the flaw simply by requesting that URL, achieving disclosure of the stored LDAP logs. The issue carries a CVSS 3.1 score of 7.5 with an attack vector of network, low complexity, and no required privileges or user interaction.
The referenced WPScan advisories document the exposure and identify the affected plugin versions. The EPSS score has reached 0.7779 at both its current and peak values.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-57349
Vulnerability Data
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users…
more
knowing the URL to do so.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.