Auth bypass in Fedoraproject Fedora
CVE-2022-1949
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.015 (73.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: +0.000
Affected products
- Fedoraproject Fedora — versions 34, 35, 36
- Red Hat 389 Directory Server
- Red Hat Directory Server — versions 11.0, 12.0
- Red Hat Enterprise Linux — versions 8.0, 9.0
- 389-Ds-Base — versions 389-ds-base-2.0
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Patch, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2022-1949?
- CVE-2022-1949 is a high-severity vulnerability in Fedoraproject Fedora, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.5/10. Published 2022-06-02.
- How severe is CVE-2022-1949?
- High severity. CVSS v3 base score is 7.5 out of 10.