Lucene search

[email protected]CVE-2013-1897

HistoryMay 13, 2013 - 11:55 p.m.

CVE-2013-1897

2013-05-1323:55:01

CWE-264

[email protected]

web.nvd.nist.gov

cve-2013-1897

389 directory server

ldap

remote attack

sensitive information

nvd

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

5.8 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.6%

JSON

The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.

Affected configurations

NVD

Node

fedoraproject389_directory_serverMatch1.2.1

fedoraproject389_directory_serverMatch1.2.2

fedoraproject389_directory_serverMatch1.2.3

fedoraproject389_directory_serverMatch1.2.5

fedoraproject389_directory_serverMatch1.2.5rc1

fedoraproject389_directory_serverMatch1.2.5rc2

fedoraproject389_directory_serverMatch1.2.5rc3

fedoraproject389_directory_serverMatch1.2.5rc4

fedoraproject389_directory_serverMatch1.2.6

fedoraproject389_directory_serverMatch1.2.6a2

fedoraproject389_directory_serverMatch1.2.6a3

fedoraproject389_directory_serverMatch1.2.6a4

fedoraproject389_directory_serverMatch1.2.6rc1

fedoraproject389_directory_serverMatch1.2.6rc2

fedoraproject389_directory_serverMatch1.2.6rc3

fedoraproject389_directory_serverMatch1.2.6rc6

fedoraproject389_directory_serverMatch1.2.6rc7

fedoraproject389_directory_serverMatch1.2.6.1

fedoraproject389_directory_serverMatch1.2.7alpha3

fedoraproject389_directory_serverMatch1.2.7.5

fedoraproject389_directory_serverMatch1.2.8alpha1

fedoraproject389_directory_serverMatch1.2.8alpha2

fedoraproject389_directory_serverMatch1.2.8alpha3

fedoraproject389_directory_serverMatch1.2.8rc1

fedoraproject389_directory_serverMatch1.2.8rc2

fedoraproject389_directory_serverMatch1.2.8.1

fedoraproject389_directory_serverMatch1.2.8.2

fedoraproject389_directory_serverMatch1.2.8.3

fedoraproject389_directory_serverMatch1.2.9.9

fedoraproject389_directory_serverMatch1.2.10

fedoraproject389_directory_serverMatch1.2.10alpha8

fedoraproject389_directory_serverMatch1.2.10rc1

fedoraproject389_directory_serverMatch1.2.10.2

fedoraproject389_directory_serverMatch1.2.10.3

fedoraproject389_directory_serverMatch1.2.10.4

fedoraproject389_directory_serverMatch1.2.10.11

fedoraproject389_directory_serverMatch1.2.11.1

fedoraproject389_directory_serverMatch1.2.11.5

fedoraproject389_directory_serverMatch1.2.11.6

fedoraproject389_directory_serverMatch1.2.11.8

fedoraproject389_directory_serverMatch1.2.11.9

fedoraproject389_directory_serverMatch1.2.11.10

fedoraproject389_directory_serverMatch1.2.11.11

fedoraproject389_directory_serverMatch1.2.11.12

fedoraproject389_directory_serverMatch1.2.11.13

fedoraproject389_directory_serverMatch1.2.11.14

fedoraproject389_directory_serverMatch1.2.11.15

fedoraproject389_directory_serverMatch1.2.11.17

fedoraproject389_directory_serverMatch1.2.11.19

Node

fedoraproject389_directory_serverMatch1.3.0.2

fedoraproject389_directory_serverMatch1.3.0.3

fedoraproject389_directory_serverMatch1.3.0.4

CPENameOperatorVersion
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.1
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.2
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.3
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.5
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.6
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.6.1
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.7
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.7.5
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.8
fedoraproject:389_directory_serverfedoraproject 389 directory servereq1.2.8.1

CPE	Name	Operator	Version
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.1
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.2
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.3
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.5
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.6
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.6.1
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.7
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.7.5
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.8
fedoraproject:389_directory_server	fedoraproject 389 directory server	eq	1.2.8.1