2.6 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:N/A:N
0.005 Low
EPSS
Percentile
77.6%
The do_search function in ldap/servers/slapd/search.c in 389 Directory
Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly
restrict access to entries when the nsslapd-allow-anonymous-access
configuration is set to rootdse and the BASE search scope is used, which
allows remote attackers to obtain sensitive information outside of the
rootDSE via a crafted LDAP search.
git.fedorahosted.org/cgit/389/ds.git/commit/?h=389-ds-base-1.2.11&id=5a18c828533a670e7143327893f8171a19062286
fedorahosted.org/389/ticket/47308
launchpad.net/bugs/cve/CVE-2013-1897
nvd.nist.gov/vuln/detail/CVE-2013-1897
security-tracker.debian.org/tracker/CVE-2013-1897
www.cve.org/CVERecord?id=CVE-2013-1897