Lucene search

[email protected]CVE-2010-3282

HistoryJan 09, 2020 - 9:15 p.m.

CVE-2010-3282

2020-01-0921:15:00

CWE-312

[email protected]

web.nvd.nist.gov

cve-2010-3282

389 directory server

password logging

security vulnerability

cleartext password

audit logging

sensitive information disclosure

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6 Medium

AI Score

Confidence

Low

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.2%

JSON

389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log.

CPENameOperatorVersion
hp:hp-ux_directory_serverhp hp-ux directory serverltb.08.10.03
redhat:redhat_directory_serverredhat redhat directory serverltb.08.00.02
fedoraproject:389_directory_serverfedoraproject 389 directory serverlt1.2.7.1
redhat:directory_serverredhat directory servereq8.0

CPE	Name	Operator	Version
hp:hp-ux_directory_server	hp hp-ux directory server	lt	b.08.10.03
redhat:redhat_directory_server	redhat redhat directory server	lt	b.08.00.02
fedoraproject:389_directory_server	fedoraproject 389 directory server	lt	1.2.7.1
redhat:directory_server	redhat directory server	eq	8.0

References

oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6914

bugzilla.redhat.com/show_bug.cgi?id=625950

git.fedorahosted.org/cgit/389/ds.git/commit/?id=d38ae06

support.hpe.com/hpsc/doc/public/display?docId=emr_na-c02522633&docLocale=en_US

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6 Medium

AI Score

Confidence

Low

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.2%

JSON

Related for CVE-2010-3282

prion2 securityvulns2 openvas2 cve1