Lucene search

[email protected]CVE-2019-10224

HistoryNov 25, 2019 - 4:15 p.m.

CVE-2019-10224

2019-11-2516:15:13

CWE-522

CWE-200

[email protected]

web.nvd.nist.gov

cve-2019-10224

389-ds-base

version 1.4

information disclosure

vulnerability

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

4.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.4%

JSON

A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.

Affected configurations

Vulners

NVD

Node

redhat389_directory_serverRange1.4.0.0–1.4.1.3

VendorProductVersionCPE
redhat389_directory_server*cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	389_directory_server	*	cpe:2.3:o:redhat:389_directory_server::::::::

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "389-ds-base",
    "versions": [
      {
        "version": "389-ds-base 1.4.x.x before 1.4.1.3",
        "status": "affected"
      }
    ]
  }
]