Vulnerability in [Unknown] 389-Ds-Base
CVE-2018-10871
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.
EPSS: 0.008 (54.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.8 (Low). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N.
Affected products
- [Unknown] 389-ds-base — versions 389-ds-base 1.3.8.5, 389-ds-base 1.4.0.12
- Debian Debian_linux — versions 8.0
- Fedoraproject 389_directory_server
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation, Issue Tracking)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2018-10871?
- CVE-2018-10871 is a low-severity vulnerability in [Unknown] 389-Ds-Base, classified under Cleartext Storage of Sensitive Information. CVSS score: 3.8/10. Published 2018-07-18.
- How severe is CVE-2018-10871?
- Low severity. CVSS v3 base score is 3.8 out of 10.