CVE-2019-14824

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.

Score

CVSS 3.1 6.5 Medium

Status

Modified - secalert@redhat.com

Published

2019-11-08

Last modified

2025-02-13

Weaknesses

CWE-732

Affected products

• Debian Linux (Debian)
• 389 Directory Server (Fedoraproject)
• Enterprise Linux (Redhat)
• 389-ds-base (Unknown)

References

• https://access.redhat.com/errata/RHSA-2019:3981
• https://access.redhat.com/errata/RHSA-2020:0464
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14824
• https://lists.debian.org/debian-lts-announce/2019/11/msg00036.html
• https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html