CVE-2022-0996 : A vulnerability was found in the 389 Directory Server that allows expired passwo

A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.

Published 2022-03-23 20:15:11

Updated 2023-04-24 09:15:09

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-0996

Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » 389 Directory Server » Version: 1.4.0.0
cpe:2.3:o:redhat:389_directory_server:1.4.0.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Assigned by: nvd@nist.gov (Primary)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYT2IQJFHQWZENJJRY6EJB3XIFZGNT7F/

[SECURITY] Fedora 35 Update: 389-ds-base-2.0.15-1.fc35 - package-announce - Fedora Mailing-Lists
https://bugzilla.redhat.com/show_bug.cgi?id=2064769

2064769 – (CVE-2022-0996) CVE-2022-0996 389-ds-base: expired password was still allowed to access the database
Issue Tracking;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QFD7CBBX3IZOSHEWL2EYKRLOEQSXCZ6/

[SECURITY] Fedora 34 Update: 389-ds-base-2.0.15-1.fc34 - package-announce - Fedora Mailing-Lists
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html

[SECURITY] [DLA 3399-1] 389-ds-base security update

CVEs referencing this url
https://github.com/ByteHackr/389-ds-base

GitHub - ByteHackr/389-ds-base
Exploit;Third Party Advisory

Jump to