Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2019-13057

Good to know:

icon

Date: July 26, 2019

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

Language: C

Severity Score

Related Resources (20)

https://www.openldap.org/lists/openldap-announce/201907/msg00001.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
https://access.redhat.com/security/cve/CVE-2019-13057
http://seclists.org/fulldisclosure/2019/Dec/26
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html
https://support.apple.com/kb/HT210788
https://nvd.nist.gov/vuln/detail/CVE-2019-13057
https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html
https://security.alpinelinux.org/vuln/CVE-2019-13057
https://security-tracker.debian.org/tracker/CVE-2019-13057
https://people.canonical.com/~ubuntu-security/cve/CVE-2019-13057
https://seclists.org/bugtraq/2019/Dec/23
https://usn.ubuntu.com/4078-1/
https://www.oracle.com/security-alerts/cpuapr2022.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html
https://usn.ubuntu.com/4078-2/
https://security.netapp.com/advisory/ntap-20190822-0004/
https://www.openldap.org/its/?findid=9038
https://www.mend.io/vulnerability-database/CVE-2019-13057

Severity Score

Weakness Type (CWE)

Authentication Issues

CWE-287

Insufficient Information

NVD-CWE-noinfo

Top Fix

icon

Upgrade Version

Upgrade to version 2.4.48

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): HIGH
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us