CVE-2022-2987

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-298717.8Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially ena CVE-2022-298728.8A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of POST requests.CVE-2022-298739.8A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET an CVE-2022-298748.8A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communica CVE-2022-298759.8A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, CVE-2022-298767.1A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request par CVE-2022-298776.5A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.0 CVE-2022-298787.5A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent duri CVE-2022-298794.3A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ CVE-2022-29887.5A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from CVE-2022-298806.5A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration i CVE-2022-298815.3A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ