CVE-2014-0132: fedoraproject 389_directory_server Improper Authentication

CVSS: 6.5v2.0MediumModified

AliasesMGASA-2014-0145RHSA-2014:0292UBUNTU-CVE-2014-0132+1 more

Published 18-03-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-0132 is a medium (CVSS 6.5) Improper Authentication vulnerability in fedoraproject 389_directory_server. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

36/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v2.0 (NVD)

EPSS score

2.19%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Timeline

18-03-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

CVSS metrics

1 score · 1 source · 1 version

v2.06.5

EPSS trend

Probability

2.19%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

0.00 pp

From 2.19% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (fedorahosted.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected systems

Redhat4 products

389-ds-base< 0:1.2.11.15-32.el6_5
389-ds-base-debuginfo< 0:1.2.11.15-32.el6_5
389-ds-base-devel< 0:1.2.11.15-32.el6_5
389-ds-base-libs< 0:1.2.11.15-32.el6_5

Mageia2 products

389-ds-base< 1.3.0.9-1.1.mga3
389-ds-base< 1.3.2.7-1.1.mga4

Debian1 product

389-ds-base< 1.3.2.9-1.1

Fedoraproject1 product

389_directory_server≤ 1.2.11.25 | 1.2.11.1 | 1.2.11.5 | 1.2.11.6 | 1.2.11.8 | 1.2.11.9 | 1.2.11.10 | 1.2.11.11 | 1.2.11.12 | 1.2.11.13 | 1.2.11.14 | 1.2.11.15 | 1.2.11.17 | 1.2.11.19 | 1.2.11.20 | 1.2.11.21 | 1.2.11.22 | 1.2.11.23

Ubuntu1 product