CVE-2020-35518

State: Published
Severity: Not scored
Published: Mar 26, 2021
Updated: Aug 4, 2024
Reserved: Dec 17, 2020

Description

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Scores

The record has no CVSS score.

Weaknesses

CWE-200

Affected Products

Product	Versions
389-ds-basen/a	389-ds-base 2.0.3, 389-ds-base 1.4.4.13, 389-ds-base 1.4.3.19Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1905565
https://github.com/389ds/389-ds-base/issues/4480
https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc
https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.