CVE-2020-15259 - CVE House

Back to Database

Status published High CVE-2020-15259

CSRF in Auth0 ad-ldap-connector

8.1 CVSS

Vulnerability Description

ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on, you are not affected. The issue is fixed in version 5.0.13.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15259

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from auth0

View All →

Auth0-PHP SDK has Improper Audience Validation

Auth0 Next.js SDK has Improper Validation of Query Parameters

Auth0 Next.js SDK has Improper Request Caching Lookup

auth0/node-jws improper HMAC signature verification vulnerability

auth0-PHP: Improper File Type Handling in Bulk User Import

Affected Vendor

auth0

View all reports →

Affected Software

ad-ldap-connector

Vulnerable Versions:

< 0.0.1

Timeline

Official Publish: November 6th, 2020

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link

T1204.001 Malicious Link

T1098 Account Manipulation

T1565.001 Stored Data Manipulation