// For flags

CVE-2013-2219

Server: ACLs inoperative in some search scenarios

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.

El Red Hat Directory Server 8.2.11-13 y 389 Directory Server, no restringe adecuadamente los atributos de entidad, lo que permite a usuarios autenticados remotamente obtener información sensible a través de una consulta de búsqueda hacia ese atributo.

Red Hat Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol server and command-line utilities for server administration. It was discovered that Red Hat Directory Server did not honor defined attribute access controls when evaluating search filter expressions. A remote attacker could use this flaw to determine the values of restricted attributes via a series of search queries with filter conditions that used restricted attributes.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2013-02-19 CVE Reserved
  • 2013-07-30 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-04-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-264: Permissions, Privileges, and Access Controls
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Fedoraproject
Search vendor "Fedoraproject"
 389 Directory Server
Search vendor "Fedoraproject" for product "389 Directory Server"
--
Affected
Redhat
Search vendor "Redhat"
 Directory Server
Search vendor "Redhat" for product "Directory Server"
 <= 8.2
Search vendor "Redhat" for product "Directory Server" and version " <= 8.2"
-
Affected
Redhat
Search vendor "Redhat"
 Directory Server
Search vendor "Redhat" for product "Directory Server"
 7.1
Search vendor "Redhat" for product "Directory Server" and version "7.1"
-
Affected
Redhat
Search vendor "Redhat"
 Directory Server
Search vendor "Redhat" for product "Directory Server"
 8.0
Search vendor "Redhat" for product "Directory Server" and version "8.0"
-
Affected
Redhat
Search vendor "Redhat"
 Directory Server
Search vendor "Redhat" for product "Directory Server"
 8.1
Search vendor "Redhat" for product "Directory Server" and version "8.1"
-
Affected