The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not…

Description

The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.

Scores

EPSS (exploitation in 30 days)

2.1% · top 18% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.6.

Weakness

• n/a
• CWE-264 (opens in a new tab)All about CWE-264 and its CVEs

Affected products

• n/a

  • affected n/a

References (6)

• FEDORA-2013-4578 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• https://git.fedorahosted.org/cgit/389/ds.git/commit/?h=389-ds-base-1.2.11&id=5a18c828533a670e7143327893f8171a19062286 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=928105 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://fedorahosted.org/freeipa/ticket/3540 (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2013:0742 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• https://fedorahosted.org/389/ticket/47308 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2013-1897](https://trackcve.app/badge/CVE-2013-1897.svg)](https://trackcve.app/cve/CVE-2013-1897)

Record last updated 6 Aug 2024, 15:20 UTC.