The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.
CVSS Details
- CVSS 3.1 Base Score: 3.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade 389-ds-baseUpgrade 389-ds-base-develUpgrade 389-ds-base-libs | Dec 1, 2016 | May 13, 2013 |
| Debian | — | Upgrade 389-ds-base | Jul 30, 2024 | May 13, 2013 |
| Oracle_linux | — | Upgrade 389-ds-baseUpgrade 389-ds-base-develUpgrade 389-ds-base-libs | Oct 16, 2024 | May 13, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub