CVE-2019-10224: fedoraproject 389_directory_server Insufficiently Protected Credentials
Vulnerability summary
CVE-2019-10224 is a medium (CVSS 4.6) Insufficiently Protected Credentials vulnerability in fedoraproject 389_directory_server. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 25-11-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.
CVSS metrics
7 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated4.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST4.3MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Debian1 product
- 389-ds-base< 1.4.1.5-1
Fedoraproject1 product
- 389_directory_server≥ 1.4.0.0, < 1.4.1.3
Red hat1 product
- 389-ds-base389-ds-base 1.4.x.x before 1.4.1.3
Ubuntu1 product
- 389-ds-baseAll versions (No fix recorded)
4 vendors · 4 products
