CVE-2023-23749: Extension - miniorange - LDAP Integration - LDAP Injection (username)

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-17 · updated 2026-06-17
Weakness: CWE-74

Description

The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.

Affected products

miniorange LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login: 5.0.2

References

https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/
https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/

Get alerted when CVE-2023-23749 or the next vulnerability affects your stack