Information Exposure

2024-01-1305:37:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

389-ds-base

information exposure

ldap

userpassword

usercertificate

sensitive information

cockpit-389-ds

hashed passwords

vulnerability

exploitation

software

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

Percentile

13.3%

JSON

389-ds-base is vulnerable to Information Exposure. The vulnerability is due to LDAP mistakenly decoding the userPassword attribute instead of the userCertificate attribute, potentially leading to the leakage of sensitive information. An attacker with local access to a system running cockpit-389-ds could exploit this flaw to view hashed passwords.