Vulnerability Details : CVE-2014-8112
389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.
Products affected by CVE-2014-8112
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.17:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.18:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.19:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.22:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.22:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.23:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.24:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.26:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.2.19:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:fedoraproject:389_directory_server:1.3.3.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-8112
0.28%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 49 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-8112
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST |
CWE ids for CVE-2014-8112
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8112
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
[SECURITY] Fedora 22 Update: 389-ds-base-1.3.3.9-1.fc22
-
https://bugzilla.redhat.com/show_bug.cgi?id=1172729
1172729 – (CVE-2014-8112) CVE-2014-8112 389-ds-base: password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off
-
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html
-
http://rhn.redhat.com/errata/RHSA-2015-0416.html
RHSA-2015:0416 - Security Advisory - Red Hat Customer Portal
-
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html
389 Directory Server - Releases/1.3.3.9
Jump to