CVE-2019-14824 Information

Description

A flaw was found in the ‘deref’ plugin of 389-ds-base where it could use the ‘search’ permission to display attribute values. In some configurations this could allow an authenticated attacker to view private attributes such as password hashes.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Reference

https://access.redhat.com/errata/RHSA-2019:3981 https://access.redhat.com/errata/RHSA-2020:0464 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14824 https://lists.debian.org/debian-lts-announce/2019/11/msg00036.html

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

6.5