CVE-2020-35518CWE-200

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not

published March 26, 2021

CVSS
—
EPSS
2%
Percentile
74.7
In the wild
Unconfirmed
What it is

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01538 · 74.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-03-26T16:43Z
EPSS history
Timeline
  • 26 MAR 16:43Z
    When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not
    cvelistv5