[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2017-15135Date: (C)2018-01-30   (M)2023-12-22


It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 8.1CVSS Score : 4.3
Exploit Score: 2.2Exploit Score: 8.6
Impact Score: 5.9Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: HIGHAccess Complexity: MEDIUM
Privileges Required: NONEAuthentication: NONE
User Interaction: NONEConfidentiality: PARTIAL
Scope: UNCHANGEDIntegrity: NONE
Confidentiality: HIGHAvailability: NONE
Integrity: HIGH 
Availability: HIGH 
  
Reference:
BID-102811
RHSA-2018:0414
RHSA-2018:0515
https://bugzilla.redhat.com/show_bug.cgi?id=1525628
openSUSE-SU-2019:1397

CWE    1
CWE-287
OVAL    9
oval:org.secpod.oval:def:1600866
oval:org.secpod.oval:def:204759
oval:org.secpod.oval:def:204768
oval:org.secpod.oval:def:1700016
...

© SecPod Technologies