CVEvulnerability

CVE-2020-35518

5.3 MEDIUM Published 2021-03-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-03-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-203

Description

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Affected configurations

• redhat 389 directory server (< 1.4.3.19) • redhat 389 directory server (>= 1.4.4.0 < 1.4.4.13) • redhat 389 directory server (>= 2.0.0 < 2.0.3) • redhat directory server 11.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-203 Observable Discrepancy weakness

References