LDAP Integration with Active Directory and OpenLDAP (com_miniorange_dirsync) <= 5.0.2 - Unauthenticated LDAP Injection

The miniOrange "LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login" extension does not sanitise the username POST parameter before building the LDAP query, so an unauthenticated attacker can inject LDAP filter syntax at the login form and dump arbitrary contents from the directory (CVE-2023-23749, CVSS 3.1 7.5 HIGH, AV:N/AC:L/PR:N/UI:N). The Joomla CNA records 5.0.2 as affected and 6.0.0 as unaffected; 5.0.2 is the only version the CNA tested, so this rule flags 5.0.2 and anything below it, which is the safe superset. The extension installs as a bundle whose component, System plugin (miniorangedirsync) and Authentication plugin (moldap) all carry the same version number, so the component version is a reliable indicator of the bundle version even though the injection itself is in the authentication path. Update to 6.0.0 or later.

Affected versions: ≤ 5.0.2

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions