← Retour aux CVEs

CVE-2023-1055

MEDIUM

5.5

Description

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

Details CVE

Score CVSS v3.15.5

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueLOCAL

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie2/27/2023

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

fedoraproject:fedoraredhat:directory_server

Faiblesses (CWE)

CWE-200CWE-295

References

https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0(secalert@redhat.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2173517#c0(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZOYQ5TCV6ZEPMDV4CSLK3KINAAO4SRI/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.