CVE-2019-14824

Description

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.

References

https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html

https://lists.debian.org/debian-lts-announce/2019/11/msg00036.html

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14824

https://access.redhat.com/errata/RHSA-2020:0464

https://access.redhat.com/errata/RHSA-2019:3981

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3