Information disclosure

2013-05-1323:55:00

PRIOn knowledge base

www.prio-n.com

6.4 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.6%

JSON

The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.

CPENameOperatorVersion
389_directory_servereq1.2.5 rc4
389_directory_servereq1.2.3
389_directory_servereq1.2.11.9
389_directory_servereq1.2.5 rc1
389_directory_servereq1.2.8 rc2
389_directory_servereq1.2.8 rc1
389_directory_servereq1.2.9.9
389_directory_servereq1.2.11.8
389_directory_servereq1.2.8.3
389_directory_servereq1.2.6 rc3

Name	Operator	Version
389_directory_server	eq	1.2.5 rc4
389_directory_server	eq	1.2.3
389_directory_server	eq	1.2.11.9
389_directory_server	eq	1.2.5 rc1
389_directory_server	eq	1.2.8 rc2
389_directory_server	eq	1.2.8 rc1
389_directory_server	eq	1.2.9.9
389_directory_server	eq	1.2.11.8
389_directory_server	eq	1.2.8.3
389_directory_server	eq	1.2.6 rc3