Information Disclosure

2019-01-1509:05:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.005 Low

EPSS

Percentile

75.8%

JSON

389-ds-base is vulnerable to information disclosure attacks. The vulnerability exists as 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the “cn=changelog” LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

CPENameOperatorVersion
389-ds-baseeq1.2.11.15__14.el6_4
389-ds-baseeq1.2.11.15__30.el6_5
389-ds-baseeq1.2.11.15__31.el6_5
389-ds-baseeq1.2.11.15__46.el6
389-ds-baseeq1.2.11.15__48.el6_6
389-ds-baseeq1.2.10.2__18.el6_3
389-ds-baseeq1.2.11.15__20.el6_4
389-ds-baseeq1.2.11.15__45.el6
389-ds-baseeq1.2.11.15__34.el6_5
389-ds-baseeq1.2.10.2__20.el6_3

Name	Operator	Version
389-ds-base	eq	1.2.11.15__14.el6_4
389-ds-base	eq	1.2.11.15__30.el6_5
389-ds-base	eq	1.2.11.15__31.el6_5
389-ds-base	eq	1.2.11.15__46.el6
389-ds-base	eq	1.2.11.15__48.el6_6
389-ds-base	eq	1.2.10.2__18.el6_3
389-ds-base	eq	1.2.11.15__20.el6_4
389-ds-base	eq	1.2.11.15__45.el6
389-ds-base	eq	1.2.11.15__34.el6_5
389-ds-base	eq	1.2.10.2__20.el6_3