Information Disclosure

2019-01-1508:51:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.005 Low

EPSS

Percentile

77.6%

JSON

389 Directory Server is vulnerable to information disclosure. This is due to improper access restriction in the do_search function in ldap/servers/slapd/search.c when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, allowing a remote attacker to retrieve confidential information outside of rootDSE via a malicious LDAP search.

CPENameOperatorVersion
389-ds-baseeq1.2.10.2__20.el6_3
389-ds-baseeq1.2.11.15__11.el6
389-ds-baseeq1.2.8.2__1.el6
389-ds-baseeq1.2.11.15__12.el6_4
389-ds-baseeq1.2.10.2__15.el6
389-ds-baseeq1.2.10.2__18.el6_3
389-ds-baseeq1.2.8.2__1.el6_1.3
389-ds-baseeq1.2.9.14__1.el6_2.2
389-ds-baseeq1.2.9.14__1.el6

Name	Operator	Version
389-ds-base	eq	1.2.10.2__20.el6_3
389-ds-base	eq	1.2.11.15__11.el6
389-ds-base	eq	1.2.8.2__1.el6
389-ds-base	eq	1.2.11.15__12.el6_4
389-ds-base	eq	1.2.10.2__15.el6
389-ds-base	eq	1.2.10.2__18.el6_3
389-ds-base	eq	1.2.8.2__1.el6_1.3
389-ds-base	eq	1.2.9.14__1.el6_2.2
389-ds-base	eq	1.2.9.14__1.el6