{
  "GSD": {
    "alias": "CVE-2023-23749",
    "id": "GSD-2023-23749"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-23749"
      ],
      "details": "The \u0027LDAP Integration with Active Directory and OpenLDAP - NTLM \u0026 Kerberos Login\u0027 extension is vulnerable to LDAP Injection since is not properly sanitizing the \u0027username\u0027 POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.",
      "id": "GSD-2023-23749",
      "modified": "2023-12-13T01:20:49.595506Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@joomla.org",
        "ID": "CVE-2023-23749",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "LDAP Integration with Active Directory and OpenLDAP - NTLM \u0026 Kerberos Login",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "5.0.2"
                        },
                        {
                          "version_affected": "!",
                          "version_value": "6.0.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "miniorange"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The \u0027LDAP Integration with Active Directory and OpenLDAP - NTLM \u0026 Kerberos Login\u0027 extension is vulnerable to LDAP Injection since is not properly sanitizing the \u0027username\u0027 POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "LDAP injection"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/",
            "refsource": "MISC",
            "url": "https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:miniorange:ldap_integration_with_active_directory_and_openldap:5.0.2:*:*:*:*:joomla\\!:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@joomla.org",
          "ID": "CVE-2023-23749"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The \u0027LDAP Integration with Active Directory and OpenLDAP - NTLM \u0026 Kerberos Login\u0027 extension is vulnerable to LDAP Injection since is not properly sanitizing the \u0027username\u0027 POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-74"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-01-27T18:18Z",
      "publishedDate": "2023-01-17T20:15Z"
    }
  }
}