CVE-2019-14824CWE-732

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values

Medium · published November 8, 2019

CVSS v3.0
6.5
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01306 · 70.3th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2019-11-08T14:45Z
EPSS history
Timeline
  • 08 NOV 14:45Z
    A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values
    cvelistv5