CVE-2019-5648CWE-522

LDAP Credential Exposure in Barracuda Load Balancer ADC

High · published March 12, 2020

CVSS v3.0
8.7
EPSS
1%
Percentile
66.0
In the wild
Unconfirmed
What it is

Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. These steps can be used by any authenticated administrative user to expose the LDAP credentials configured in the LDAP connector over the network.

The record
Technical detail
CVSS v3.0
8.7 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01125 · 66.0th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2020-03-12T13:00Z
EPSS history
Timeline
  • 12 MAR 13:00Z
    LDAP Credential Exposure in Barracuda Load Balancer ADC
    cvelistv5