CVE-2010-3282

389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log.

Score

CVSS 3.1 3.3 Low

Status

Modified - hp-security-alert@hp.com

Published

2020-01-09

Last modified

2024-08-07

Weaknesses

CWE-312

Affected products

• 389 Directory Server (Fedoraproject)
• Hp-ux Directory Server (Hp)
• 389 Directory Server (Red Hat)
• Directory Server (Redhat)
• Redhat Directory Server (Redhat)

References

• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6914
• https://bugzilla.redhat.com/show_bug.cgi?id=625950
• https://git.fedorahosted.org/cgit/389/ds.git/commit/?id=d38ae06
• https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c02522633&docLocale=en_US