6.5
CVE-2019-14824
- EPSS 1.3%
- Veröffentlicht 08.11.2019 15:15:11
- Zuletzt bearbeitet 21.11.2024 04:27:26
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
LoginA flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ 389 Directory Server Version-
Redhat ≫ Enterprise Linux Version7.0
Debian ≫ Debian Linux Version8.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.3% | 0.667 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:P/I:N/A:N
|
| secalert@redhat.com | 6.5 | 2.8 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-732 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
https://access.redhat.com/errata/RHSA-2019:3981
https://access.redhat.com/errata/RHSA-2020:0464
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14824
https://lists.debian.org/debian-lts-announce/2019/11/msg00036.html