VulnerabilityAnalyzed
CVE-2023-44038
In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack.
MEDIUM 6.5EPSS 0.31%
Does this matter?
Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.
Description
In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.31% probability · 24th percentile
- CISA KEV
- Not listed
- Affected
- veridiumid/veridiumad
- Source
- cve@mitre.org
References
- https://docs.veridiumid.com/docs/v3.5/security-advisory#id-%28v3.52%29SecurityAdvisory-AcknowledgementVendor Advisory
- https://veridiumid.com/veridium-id-authentication-platform/Product
- https://docs.veridiumid.com/docs/v3.5/security-advisory#id-%28v3.52%29SecurityAdvisory-AcknowledgementVendor Advisory
- https://veridiumid.com/veridium-id-authentication-platform/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.