« Volver al listado

CVE-2014-8105

Estado: ModificadaMedia (5)—

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fedoraproject — 389 Directory ServerFedoraproject — Fedora

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-8105",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-03-10T14:59:00.070",
  "references": [
    {
      "url": "http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0416.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0628.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0416.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0628.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the \"cn=changelog\" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "389 Directory Server anterior a 1.3.2.27 y 1.3.3.x anterior a 1.3.3.9 no restringe correctamente acceso al subárbol LDAP 'cn=changelog', lo que permite a atacantes remotos obtener información sensible del registro de cambios (changelog) a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:16:16.583",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B301991-61EC-447E-A220-29D17E8FDABD",
              "versionEndIncluding": "1.3.2.26"
            },
            {
              "criteria": "cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80EE57EB-D603-40A5-84F5-BEA703D8A0EF"
            },
            {
              "criteria": "cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6E18AB1-FE95-49F2-A354-F24C4569634C"
            },
            {
              "criteria": "cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77D4A1FC-53B7-493F-9D9C-B1DA6231A3E5"
            },
            {
              "criteria": "cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1AE563B-59ED-40F4-B2FF-CDE6EFA5087B"
            },
            {
              "criteria": "cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "220041CC-C46F-4D0E-B231-0645621A7E66"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}