CVE-2008-5112
published 2008-11-17CVE-2008-5112: The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on…
PriorityP339medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
19.96%
97.1th percentile
The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on whether the user account exists and is permitted to login, which allows remote attackers to enumerate valid usernames via a series of LDAP bind requests, as demonstrated by ldapuserenum.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://labs.portcullis.co.uk/application/ldapuserenum/http://www.portcullis-security.com/294.phphttp://www.securityfocus.com/bid/32305https://exchange.xforce.ibmcloud.com/vulnerabilities/46628http://labs.portcullis.co.uk/application/ldapuserenum/http://www.portcullis-security.com/294.phphttp://www.securityfocus.com/bid/32305https://exchange.xforce.ibmcloud.com/vulnerabilities/46628
2008-11-17
Published