CVE-2023-5003

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.

7.5

CVSS

25.9%

EPSS (exploit prob.)

98th

EPSS percentile

2023-10-16

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Vendor	Product	Affected versions
miniorange	active_directory_integration_/_ldap_integration	< 4.1.10

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/91f4e500-71f3-4ef6-9cc7-24a7c12a5748
https://wpscan.com/vulnerability/91f4e500-71f3-4ef6-9cc7-24a7c12a5748

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-5003