CVE-2015-1854

CWE-284 — Improper Access ControlCWE-697CWE-863 — Incorrect Authorization8 documents7 sources
Severity
7.5HIGH
EPSS
1.6%
top 18.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Fedoraproject 389 Directory ServerDebian Debian LinuxFedoraproject Fedora
Timeline
PublishedSep 19
Latest updateMay 14

Description

389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶Debian389-ds-base< 1.3.3.10-1+2

Also affects: Debian Linux 8.0, Fedora 22

🔴Vulnerability Details

3
GHSA
GHSA-v685-gqm8-hvj7: 389 Directory Server before 1↗2022-05-14
▶
CVEList
CVE-2015-1854: 389 Directory Server before 1↗2017-09-19
▶
OSV
CVE-2015-1854: 389 Directory Server before 1↗2017-09-19
▶

📋Vendor Advisories

2
Red Hat
389-ds-base: access control bypass with modrdn↗2015-04-28
▶
Debian
CVE-2015-1854: 389-ds-base - 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access ...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-1854 389-ds-base: access control bypass with modrdn [fedora-all]↗2015-04-28
▶
Bugzilla
CVE-2015-1854 389-ds-base: access control bypass with modrdn↗2015-04-07
▶
CVE-2015-1854 (HIGH CVSS 7.5) | 389 Directory Server before 1.3.3.1 | cvebase.io