Published: 31/07/2013 Updated: 18/11/2017

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

VMScore: 356

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

The Red Hat Directory Server prior to 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat directory server
redhat directory server 8.1
redhat directory server 8.0
redhat directory server 7.1
fedoraproject 389 directory server -

Debian Bug report logs - #730115 389-ds-base: CVE-2013-4485: DoS due to improper handling of ger attr searches Package: 389-ds-base; Maintainer for 389-ds-base is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Source for 389-ds-base is src:389-ds-base (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso ...

Debian Bug report logs - #704077 CVE-2013-0336 Package: 389-ds; Maintainer for 389-ds is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Source for 389-ds is src:389-ds-base (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 27 Mar 2013 17:00:02 UTC Severity: grave Tag ...

Debian Bug report logs - #718325 389-ds-base: CVE-2013-2219: ACLs inoperative in some search scenarios Package: src:389-ds-base; Maintainer for src:389-ds-base is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 30 Jul 2013 08:36:01 UTC ...

Debian Bug report logs - #704421 389-ds-base: CVE-2013-1897: unintended information exposure when rootdse is enabled Package: 389-ds-base; Maintainer for 389-ds-base is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Source for 389-ds-base is src:389-ds-base (PTS, buildd, popcon) Reported by: Salvatore Bonac ...

Debian Bug report logs - #721222 389-ds-base: CVE-2013-4283 Package: 389-ds-base; Maintainer for 389-ds-base is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Source for 389-ds-base is src:389-ds-base (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Thu, 29 Aug 2013 08:42 ...

ns-slapd in 389 Directory Server before 1308 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguished Name (DN) in a MOD operation request 389 Directory Server does not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query ...

The Red Hat Directory Server before 8211-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute ...

CWE-264 http://rhn.redhat.com/errata/RHSA-2013-1116.html https://bugzilla.redhat.com/show_bug.cgi?id=979508 http://rhn.redhat.com/errata/RHSA-2013-1119.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730115 https://access.redhat.com/security/cve/cve-2013-2219 https://alas.aws.amazon.com/ALAS-2013-223.html

CVE-2013-2219

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect