An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade 389-ds-base | Jul 30, 2024 | Jun 2, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade 389-ds-base-libsUpgrade 389-ds-base | Oct 28, 2022 | Jun 2, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade 389-ds-baseUpgrade 389-ds-base-libs | Aug 18, 2022 | Jun 2, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade 389-ds-base-libs | Oct 11, 2022 | Jun 2, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 2, 2022 |
| Suse | — | Upgrade 389-dsUpgrade libsvrcore0Upgrade 389-ds-develUpgrade lib389Upgrade 389-ds-snmp | Oct 26, 2022 | Jun 2, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub