Information disclosure in Red Hat 389 Directory Server
CVE-2020-35518
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.015 (74.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 74.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Red Hat 389 Directory Server
- Red Hat Directory Server — versions 11.0
- Red Hat Enterprise Linux — versions 7.0, 8.0
- 389-Ds-Base — versions 389-ds-base 2.0.3, 389-ds-base 1.4.4.13, 389-ds-base 1.4.3.19
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Patch, Issue Tracking, Vendor Advisory)
- github.com/389ds/389-ds-base/issues/4480 (Patch, Third Party Advisory)
- github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc (Patch, Third Party Advisory)
- github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32 (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-35518?
- CVE-2020-35518 is a medium-severity vulnerability in Red Hat 389 Directory Server, classified under Information Disclosure. CVSS score: 5.3/10. Published 2021-03-26.
- How severe is CVE-2020-35518?
- Medium severity. CVSS v3 base score is 5.3 out of 10.