CVE-2020-35518 : When binding against a DN during authentication, the reply from 389-ds-base will

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

Published 2021-03-26 17:15:12

Updated 2022-08-05 17:42:42

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2020-35518

Redhat » Enterprise Linux » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Directory Server » Version: 11.0
cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*
Matching versions
Redhat » 389 Directory Server
Versions from including (>=) 1.4.4.0 and before (<) 1.4.4.13
cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:*
Matching versions
Redhat » 389 Directory Server
Versions from including (>=) 2.0.0 and before (<) 2.0.3
cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:*
Matching versions
Redhat » 389 Directory Server
Versions before (<) 1.4.3.19
cpe:2.3:o:redhat:389_directory_server:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-35518

Top countries where our scanners detected CVE-2020-35518

Top open port discovered on systems with this issue 53

IPs affected by CVE-2020-35518 693,251

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-35518!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-35518

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-35518

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2020-35518

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: secalert@redhat.com (Secondary)
CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-35518

https://github.com/389ds/389-ds-base/issues/4480

Unexpected info returned to ldap request · Issue #4480 · 389ds/389-ds-base · GitHub
Patch;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1905565

1905565 – (CVE-2020-35518) CVE-2020-35518 389-ds-base: information disclosure during the binding of a DN
Issue Tracking;Patch;Vendor Advisory
https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bc

Issue 4480 - Unexpected info returned to ldap request (#4491) · 389ds/389-ds-base@cc0f692 · GitHub
Patch;Third Party Advisory
https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32

Issue 4609 - CVE - info disclosure when authenticating · 389ds/389-ds-base@b6aae4d · GitHub
Patch;Third Party Advisory