CVE-2018-1057CWE-863

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing…

published March 13, 2018

CVSS

—

EPSS

10%

Percentile

95.6

In the wild

Unconfirmed

What it is

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.10040 · 95.6th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2018-03-13T16:00Z

EPSS history

Timeline

13 MAR 16:00Z
On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing…
cvelistv5