Vulnerability CVE-2019-13057
Published: 2019-07-26

Description:
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

Type:

CWE-287

 (Improper Authentication)

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Openldap -> Openldap 
Canonical -> Ubuntu linux 

 References:
https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html
https://security.netapp.com/advisory/ntap-20190822-0004/
https://usn.ubuntu.com/4078-1/
https://usn.ubuntu.com/4078-2/
https://www.openldap.org/its/?findid=9038
https://www.openldap.org/lists/openldap-announce/201907/msg00001.html
Copyright 2024, cxsecurity.com

 

Back to Top