Vulnerability Details : CVE-2012-2746
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
Products affected by CVE-2012-2746
- cpe:2.3:a:redhat:directory_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:directory_server:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:directory_server:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:directory_server:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:rc7:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:a2:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.5:rc4:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:rc3:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:rc2:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:a4:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.5:rc3:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.5:rc2:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:rc6:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.6:a3:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.8:alpha1:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.7:alpha3:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.8:alpha2:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.8:rc1:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.8:alpha3:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.8:rc2:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.9.9:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.10:alpha8:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.10:rc1:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-2746
0.41%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-2746
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:N/AC:H/Au:S/C:P/I:N/A:N |
3.9
|
2.9
|
NIST |
CWE ids for CVE-2012-2746
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-2746
-
http://rhn.redhat.com/errata/RHSA-2012-0997.html
RHSA-2012:0997 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/76595
389 Directory Server logging information disclosure CVE-2012-2746 Vulnerability Report
-
http://www.securityfocus.com/bid/54153
389 Directory Server Multiple Information Disclosure Vulnerabilities
-
https://bugzilla.redhat.com/show_bug.cgi?id=833482
833482 – (CVE-2012-2746) CVE-2012-2746 rhds/389: plaintext password disclosure in audit logVendor Advisory
-
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03772083
HP Support for Technical Help and Troubleshooting | HP® Customer Service.
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19241
Repository / Oval Repository
-
http://directory.fedoraproject.org/wiki/Release_Notes
Vendor Advisory
-
https://fedorahosted.org/389/ticket/365
Issue #365: Audit log - clear text password in user changes - 389-ds-base - Pagure.ioVendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-1041.html
RHSA-2012:1041 - Security Advisory - Red Hat Customer PortalVendor Advisory
Jump to