CVE-2020-15259

ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on, you are not affected. The issue is fixed in version 5.0.13.

• CWE-352

• https://github.com/auth0/ad-ldap-connector/commit/8b793631ec5ecacf63ff3ece23231a9e138ae911Patch, Third Party Advisory
• https://github.com/auth0/ad-ldap-connector/security/advisories/GHSA-vx5q-cp9v-427vThird Party Advisory
• https://github.com/auth0/ad-ldap-connector/commit/8b793631ec5ecacf63ff3ece23231a9e138ae911Patch, Third Party Advisory
• https://github.com/auth0/ad-ldap-connector/security/advisories/GHSA-vx5q-cp9v-427vThird Party Advisory

Published

Nov 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15253Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scri…4.8
• CVE-2020-15254Crossbeam is a set of tools for concurrent programming. In c…9.8
• CVE-2020-15255In Anuko Time Tracker before verion 1.19.23.5325, due to not…7.3
• CVE-2020-15256A prototype pollution vulnerability has been found in `objec…9.8
• CVE-2020-15257containerd is an industry-standard container runtime and is …5.2
• CVE-2020-15258In Wire before 3.20.x, `shell.openExternal` was used without…8
• CVE-2020-1526An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15260PJSIP is a free and open source multimedia communication lib…6.8
• CVE-2020-15261On Windows the Veyon Service before version 4.4.2 contains a…6.7
• CVE-2020-15262In webpack-subresource-integrity before version 1.5.1, all d…3.7
• CVE-2020-15263In platform before version 9.4.4, inline attributes are not …6.1
• CVE-2020-15264The Boxstarter installer before version 2.13.0 configures C:…7.8