CVE-2014-8105

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-8105
389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
http://rhn.redhat.com/errata/RHSA-2015-0416.html
http://rhn.redhat.com/errata/RHSA-2015-0628.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.5:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.8:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
History

13 Feb 2023, 00:42

Type Values Removed Values Added
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1167858', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1167858', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:0628', 'name': 'https://access.redhat.com/errata/RHSA-2015:0628', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:0416', 'name': 'https://access.redhat.com/errata/RHSA-2015:0416', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-8105', 'name': 'https://access.redhat.com/security/cve/CVE-2014-8105', 'tags': [], 'refsource': 'MISC'}
Summary An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive information such as plain-text passwords. 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

02 Feb 2023, 16:16

Type Values Removed Values Added
Summary 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors. An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive information such as plain-text passwords.
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1167858 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:0628 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:0416 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-8105 -
Information

Published : 2015-03-10 14:59

Updated : 2023-12-10 11:31

NVD link : CVE-2014-8105

Mitre link : CVE-2014-8105

CVE.ORG link : CVE-2014-8105

JSON object : View

Products Affected

fedoraproject

  • 389_directory_server
  • fedora
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor