Staff / Employee Business Directory for Active Directory <= 1.2.3 - Authenticated (Admin+) LDAP Passback
Strategic Overview
- Status
- Patched in 1.3
- Affected Plugin
- Staff/Employee Business Directory for Active Directory
- Affected Version
<= 1.2.3- CVSS
- 2.2Low
- Weakness type
- CWE-306 · Missing Authentication for Critical Function
- CVE
CVE-2023-4505
At a glance
CVE-2023-4505 is a low-severity Missing Authentication for Critical Function vulnerability in the Staff/Employee Business Directory for Active Directory WordPress plugin, affecting versions <= 1.2.3. It carries a CVSS score of 2.2 (reachable over the network). Exploitation requires an authenticated account at Admin level or above. The issue is fixed in version 1.3; sites on affected versions should update now. Disclosed September 2023, reported by Pedro José Navas Pérez.
Vulnerability Overview
The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, and no interaction from a victim user.
CWE-306: Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Remediation
Update to version 1.3, or a newer patched version
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Staff/Employee Business Directory for Active Directory 1.3 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Related records
Other vulnerabilities in Staff/Employee Business Directory for Active Directory
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C