CVE-2008-5112: microsoft windows

Vulnerability summary

CVE-2008-5112 is a medium (CVSS 5.0) vulnerability in microsoft windows. EPSS estimates a 17.45% chance of exploitation in the next 30 days, higher than 97.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 17-11-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on whether the user account exists and is permitted to login, which allows remote attackers to enumerate valid usernames via a series of LDAP bind requests, as demonstrated by ldapuserenum.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.