CVE-2014-8112

389 Directory Server 1.3.1.x, 1.3.2.x < 1.3.2.27, 1.3.3.x < 1.3.3.9 - Sensitive Info Exposure via Changelog

Title source: llm
STIX 2.1

Description

389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.

References (5)

Core 5
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1172729
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0416.html

Scores

EPSS 0.0169
EPSS Percentile 74.3%

Details

CWE
CWE-200
Status published
Products (44)
fedoraproject/389_directory_server 1.3.1.0
fedoraproject/389_directory_server 1.3.1.1
fedoraproject/389_directory_server 1.3.1.2
fedoraproject/389_directory_server 1.3.1.3
fedoraproject/389_directory_server 1.3.1.4
fedoraproject/389_directory_server 1.3.1.5
fedoraproject/389_directory_server 1.3.1.6
fedoraproject/389_directory_server 1.3.1.7
fedoraproject/389_directory_server 1.3.1.8
fedoraproject/389_directory_server 1.3.1.9
... and 34 more
Published Mar 10, 2015
Tracked Since Feb 18, 2026