The authentication vulnerability of the 389 Directory Server server, which arises from information disclosure due to inconsistencies, allows attackers to gain access to confidential data.

🗓️ 17 May 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

389 Directory Server authentication vulnerability leaks data during record checks, enabling remote attackers to access confidential data.

Reporter	Title	Published	Views	Family All 94
Tenable Nessus	Amazon Linux 2 : 389-ds-base (ALAS-2021-1650)	4 Jan 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0024: 389-ds:1.4 (ALINUX3-SA-2021:0024)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : 389-ds:1.4 (CESA-2021:1086)	9 Apr 202100:00	–	nessus
Tenable Nessus	CentOS 7 : 389-ds-base (RHSA-2021:2323)	14 Jun 202100:00	–	nessus
Tenable Nessus	Fedora 33 : 389-ds-base / dogtag-pki / freeipa / pki-core (2021-7458e2d835)	4 Mar 202100:00	–	nessus
Tenable Nessus	Fedora 32 : 389-ds-base / dogtag-pki / freeipa / pki-core (2021-dc1a4934a5)	5 Mar 202100:00	–	nessus
Tenable Nessus	MiracleLinux 8 : 389-ds:1.4 (AXSA:2021-1657:01)	20 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 7 : 389-ds-base-1.3.10.2-12.el7 (AXSA:2021-1847:03)	20 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 8 : 389-ds:1.4 bug fix and enhancement update (AXSA:2021-2281:02)	20 Jan 202600:00	–	nessus
Tenable Nessus	NewStart CGSL CORE 5.04 / MAIN 5.04 : 389-ds-base Vulnerability (NS-SA-2021-0111)	28 Oct 202100:00	–	nessus

Vulners

Node

fedora 389_directory_serverRange<1.4.3.19

OR

fedora 389_directory_serverRange1.4.4.0–1.4.4.13

OR

fedora 389_directory_serverRange2.0.0–2.0.3

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/389ds/389-ds-base/commit/38b97faef8a6421a7a638ecdbf0b341e2b3f9ab3
github	www.github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32
github	www.github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
github	www.github.com/389ds/389-ds-base/issues/4480
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-35518
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-35518
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47
abf	www.abf.rosa.ru/advisories/ROSA-SA-2024-2505

05 Mar 2025 00:00Current

6Medium risk

Vulners AI Score6

CVSS 25

CVSS 35.3

EPSS0.01538

directory server authentication vulnerability information disclosure record existence check remote attackers confidential data