CVE-2018-10871
- State
- Published
- Severity
- 3.8 Low
- Published
- Jul 18, 2018
- Updated
- Aug 5, 2024
- Reserved
- May 9, 2018
Description
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 3.8 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
389-ds-base[UNKNOWN] |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.