CVE-2015-1854

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-1854
389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157069.html Mailing List Third Party Advisory
http://www.securityfocus.com/bid/74392 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2015:0895 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1209573 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
History

13 Feb 2023, 00:47

Type Values Removed Values Added
Summary A flaw was found in the way Red Hat Directory Server performed authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could use this flaw to perform unauthorized modifications of entries in the directory server. 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-1854', 'name': 'https://access.redhat.com/security/cve/CVE-2015-1854', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:20

Type Values Removed Values Added
Summary 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. A flaw was found in the way Red Hat Directory Server performed authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could use this flaw to perform unauthorized modifications of entries in the directory server.
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-1854 -
Information

Published : 2017-09-19 15:29

Updated : 2023-12-10 12:15

NVD link : CVE-2015-1854

Mitre link : CVE-2015-1854

CVE.ORG link : CVE-2015-1854

JSON object : View

Products Affected

debian

  • debian_linux

fedoraproject

  • 389_directory_server
  • fedora
CWE
CWE-284

Improper Access Control