Login Request a demo
Medium severity · published Nov 25, 2019
CVE-2019-10224
A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3
4.6
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3D
389 Directory Server · Fedoraproject
1.4.0.0 before 1.4.1.3 · source: NVD
Affected product
3D
389 Directory Server
Fedoraproject
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10224
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10224
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
Third Party Advisory
https://pagure.io/389-ds-base/issue/50251
More from 389 Directory Server
9.8
CVE-2017-7551
389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts
8.1
CVE-2017-15135
It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process
7.5
CVE-2019-10171
It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5
7.5
CVE-2019-3883
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads
7.5
CVE-2018-14648
A flaw was found in 389 Directory Server