Vulnerability Details CVE-2023-41580
Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 67.3%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2023-41580
-
cpe:2.3:a:phpipam:phpipam:-
-
cpe:2.3:a:phpipam:phpipam:0.1
-
cpe:2.3:a:phpipam:phpipam:0.2
-
cpe:2.3:a:phpipam:phpipam:0.3
-
cpe:2.3:a:phpipam:phpipam:0.4
-
cpe:2.3:a:phpipam:phpipam:0.5
-
cpe:2.3:a:phpipam:phpipam:0.6
-
cpe:2.3:a:phpipam:phpipam:0.7
-
cpe:2.3:a:phpipam:phpipam:0.8
-
cpe:2.3:a:phpipam:phpipam:0.9
-
cpe:2.3:a:phpipam:phpipam:1.0
-
cpe:2.3:a:phpipam:phpipam:1.1
-
cpe:2.3:a:phpipam:phpipam:1.1.010
-
cpe:2.3:a:phpipam:phpipam:1.2
-
cpe:2.3:a:phpipam:phpipam:1.3
-
cpe:2.3:a:phpipam:phpipam:1.3.1
-
cpe:2.3:a:phpipam:phpipam:1.3.2
-
cpe:2.3:a:phpipam:phpipam:1.4
-
cpe:2.3:a:phpipam:phpipam:1.4.1
-
cpe:2.3:a:phpipam:phpipam:1.4.2
-
cpe:2.3:a:phpipam:phpipam:1.4.3
-
cpe:2.3:a:phpipam:phpipam:1.4.4
-
cpe:2.3:a:phpipam:phpipam:1.4.5
-
cpe:2.3:a:phpipam:phpipam:1.4.6
-
cpe:2.3:a:phpipam:phpipam:1.4.7
-
cpe:2.3:a:phpipam:phpipam:1.5.0
-
cpe:2.3:a:phpipam:phpipam:1.5.1