CVEvulnerability

CVE-2022-1949

7.5 HIGH Published 2022-06-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-06-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-639

Description

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Affected configurations

• redhat 389 directory server (>= 1.3.0.0 <= 2.0.0) • redhat directory server 11.0 • redhat directory server 12.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • fedoraproject fedora 34 • fedoraproject fedora 35 • fedoraproject fedora 36

Related

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References