Unscored severity · published Jul 3, 2012
CVE-2012-2746
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new…
–
CVSS
1.3%
EPSS
No
On KEV
Description
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3D
389 Directory Server · Fedoraproject
through 1.2.11.5; 1.2.1; 1.2.2; 1.2.3; 1.2.5; 1.2.5; +32 more · source: NVD
DS
Directory Server · Redhat
through 8.2; 7.1; 8.0; 8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2746
Vendor Advisory
http://directory.fedoraproject.org/wiki/Release_Notes
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-0997.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1041.html
Vendor Advisory
http://secunia.com/advisories/49734
www.osvdb.org
http://www.osvdb.org/83329
www.securityfocus.com
http://www.securityfocus.com/bid/54153
More from 389 Directory Server
9.8
CVE-2017-7551
389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts
8.1
CVE-2017-15135
It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process
7.5
CVE-2019-10171
It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5
7.5
CVE-2019-3883
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads
7.5
CVE-2018-14648
A flaw was found in 389 Directory Server