CVE-2020-35518
26.03.2021, 17:15
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | 389_directory_server | 𝑥 < 1.4.3.19 |
| redhat | 389_directory_server | 1.4.4.0 ≤ 𝑥 < 1.4.4.13 |
| redhat | 389_directory_server | 2.0.0 ≤ 𝑥 < 2.0.3 |
| redhat | directory_server | 11.0 |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 8.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-203 - Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
References