CVE-2017-9267CWE-757

eDirectory LDAP peer certificate validation issue

Medium · published March 2, 2018

CVSS v3.0
6.5
EPSS
1%
Percentile
63.1
In the wild
Unconfirmed
What it is

In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operations.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01026 · 63.1th percentile
Weakness
CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Published
2018-03-02T20:00Z
EPSS history
Timeline
  • 02 MAR 20:00Z
    eDirectory LDAP peer certificate validation issue
    cvelistv5