CVE-2012-4450
389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible)
Severity Score
6.0
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.
389 Directory Server v1.2.10 no actualiza correctamente las ACL cuando una entrada DN es movida por una operaciĆ³n modrdn, lo que permite a usuarios autenticados con ciertos permisos, evitar restricciones ACL y de acceso a entrada DN.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-08-21 CVE Reserved
- 2012-10-01 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (10)
URL | Tag | Source |
---|---|---|
http://www.openwall.com/lists/oss-security/2012/09/26/3 | Mailing List | |
http://www.openwall.com/lists/oss-security/2012/09/26/5 | Mailing List | |
http://www.securityfocus.com/bid/55690 | Vdb Entry | |
https://bugzilla.redhat.com/show_bug.cgi?id=860772 | X_refsource_misc | |
https://fedorahosted.org/389/ticket/340 | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://git.fedorahosted.org/cgit/389/ds.git/commit/?id=5beb93d42efb807838c09c5fab898876876f8d09 | 2013-03-08 |
URL | Date | SRC |
---|---|---|
http://rhn.redhat.com/errata/RHSA-2013-0503.html | 2013-03-08 | |
http://secunia.com/advisories/50713 | 2013-03-08 | |
https://access.redhat.com/security/cve/CVE-2012-4450 | 2013-02-20 | |
https://bugzilla.redhat.com/show_bug.cgi?id=860603 | 2013-02-20 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Fedoraproject Search vendor "Fedoraproject" | 389 Directory Server Search vendor "Fedoraproject" for product "389 Directory Server" | 1.2.10 Search vendor "Fedoraproject" for product "389 Directory Server" and version "1.2.10" | - |
Affected
|