Lucene search

RedhatCVE-2023-1055

HistoryFeb 27, 2023 - 10:15 p.m.

CVE-2023-1055

2023-02-2722:15:09

CWE-200

CWE-295

redhat

web.nvd.nist.gov

cve-2023-1055

rhds

ldap

userpassword

usercertificate

data confidentiality

information security

vulnerability

nvd

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

Percentile

13.3%

JSON

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Affected configurations

Nvd

Vulners

Node

redhatdirectory_serverMatch11.5

redhatdirectory_serverMatch11.6

redhatdirectory_serverMatch12.0

redhatdirectory_serverMatch12.1

Node

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

fedoraprojectfedoraMatch38

VendorProductVersionCPE
redhatdirectory_server11.5cpe:2.3:a:redhat:directory_server:11.5:*:*:*:*:*:*:*
redhatdirectory_server11.6cpe:2.3:a:redhat:directory_server:11.6:*:*:*:*:*:*:*
redhatdirectory_server12.0cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*
redhatdirectory_server12.1cpe:2.3:a:redhat:directory_server:12.1:*:*:*:*:*:*:*
fedoraprojectfedora36cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
fedoraprojectfedora37cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
fedoraprojectfedora38cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	directory_server	11.5	cpe:2.3:a:redhat:directory_server:11.5:::::::*
redhat	directory_server	11.6	cpe:2.3:a:redhat:directory_server:11.6:::::::*
redhat	directory_server	12.0	cpe:2.3:a:redhat:directory_server:12.0:::::::*
redhat	directory_server	12.1	cpe:2.3:a:redhat:directory_server:12.1:::::::*
fedoraproject	fedora	36	cpe:2.3:o:fedoraproject:fedora:36:::::::*
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*
fedoraproject	fedora	38	cpe:2.3:o:fedoraproject:fedora:38:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Red Hat Directory Server",
    "versions": [
      {
        "version": "11 and 12",
        "status": "affected"
      }
    ]
  }
]