CVE-2014-8105

389 Directory Server <1.3.2.27/1.3.3.x<1.3.3.9 - Unauthenticated Sensitive Info Exposure via Changelog

Title source: llm
STIX 2.1

Description

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

References (5)

Core 5
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0416.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0628.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html

Scores

EPSS 0.0211
EPSS Percentile 79.5%

Details

CWE
CWE-200
Status published
Products (7)
fedoraproject/389_directory_server 1.3.3.0
fedoraproject/389_directory_server 1.3.3.2
fedoraproject/389_directory_server 1.3.3.3
fedoraproject/389_directory_server 1.3.3.5
fedoraproject/389_directory_server 1.3.3.8
fedoraproject/389_directory_server < 1.3.2.26
fedoraproject/fedora 22
Published Mar 10, 2015
Tracked Since Feb 18, 2026