Unscored severity · published Mar 20, 2011
CVE-2011-1025
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access…
–
CVSS
3.9%
EPSS
No
On KEV
Description
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openldap · Openldap
2.4.6; 2.4.7; 2.4.8; 2.4.9; 2.4.10; 2.4.11; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1025
kb.juniper.net
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
openwall.com
http://openwall.com/lists/oss-security/2011/02/24/12
openwall.com
http://openwall.com/lists/oss-security/2011/02/25/13
Vendor Advisory
http://secunia.com/advisories/43331
secunia.com
http://secunia.com/advisories/43718
security.gentoo.org
http://security.gentoo.org/glsa/glsa-201406-36.xml
More from Openldap
9.8
CVE-2022-29155
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query
9.8
CVE-2010-0211
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a…
7.5
CVE-2023-2953
A vulnerability was found in openldap
7.5
CVE-2020-25710
A flaw was found in OpenLDAP in versions before 2.4.56
7.5
CVE-2020-25709
A flaw was found in OpenLDAP