Unscored severity · published Mar 18, 2014
CVE-2014-0132
The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the…
–
CVSS
2.2%
EPSS
No
On KEV
Description
The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3D
389 Directory Server · Fedoraproject
through 1.2.11.25; 1.2.11.1; 1.2.11.5; 1.2.11.6; 1.2.11.8; 1.2.11.9; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0132
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0292.html
Vendor Advisory
http://secunia.com/advisories/57412
Vendor Advisory
http://secunia.com/advisories/57427
Exploit
https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/
Patch
https://fedorahosted.org/389/ticket/47739
More from 389 Directory Server
9.8
CVE-2017-7551
389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts
8.1
CVE-2017-15135
It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process
7.5
CVE-2019-10171
It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5
7.5
CVE-2019-3883
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads
7.5
CVE-2018-14648
A flaw was found in 389 Directory Server